Check DNS, Urls + Redirects, Certificates and Content of your Website




A

Top config

Checked:
09.12.2022 02:08:24


Older results


1. IP-Addresses

HostTypeIP-Addressis auth.∑ Queries∑ Timeout
2a01:238:301b::1226
AAAA
2a01:238:301b::1226
Berlin/Land Berlin/Germany (DE) - Cronon GmbH

yes



2. DNSSEC


No DNSSEC - Informations found


3. Name Servers


No Nameserver entries found


4. SOA-Entries


No SOA entries found

5. Screenshots

Startaddress: https://www.server-daten.de/, address used: https://www.server-daten.de/, Screenshot created 2022-12-09 02:09:06 +00:0

Mobil (412px x 732px)

178 milliseconds

Screenshot mobile - https://www.server-daten.de/
Mobil + Landscape (732px x 412px)

173 milliseconds

Screenshot mobile landscape - https://www.server-daten.de/
Screen (1280px x 1680px)

324 milliseconds

Screenshot Desktop - https://www.server-daten.de/

Mobile- and other Chrome-Checks

widthheight
visual Viewport396732
content Size3961609

Good: No horizontal scrollbar. Content-size width = visual Viewport width.

6. Url-Checks


:

:
DomainnameHttp-StatusredirectSec.G
• http://2a01:238:301b::1226/
2a01:238:301b::1226
301
https://www.server-daten.de/
0.030
A
Content-Type: text/html; charset=UTF-8
Location: https://www.server-daten.de/
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Date: Fri, 09 Dec 2022 01:08:28 GMT
Connection: close
Content-Length: 0

• https://2a01:238:301b::1226/
2a01:238:301b::1226 GZip used - 1724 / 3174 - 45.68 %
Inline-JavaScript (∑/total): 0/0 Inline-CSS (∑/total): 0/0
200

Html is minified: 100.57 %
2.413
A
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
P3P: CP="NOI CUR OUR STA"
Referrer-Policy: strict-origin
Permissions-Policy: camera=(self)
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self'; connect-src 'self'; child-src 'self'; frame-src 'self'; frame-ancestors 'self'; base-uri 'self'; ; report-uri /-cspr.html
Set-Cookie: __Host-www.server-daten.de=GVWFS7lHMU+7J/ZvEFTVYsBMGLAaEnJJk3qWS5XGngO7LAOKOjwMS4idmfoYcYONMOcUi0G1kxhcGdbAvF2DLX1KVOAdgUBi8fTzE8HXFN3H2TxY+mIOzO6VTRRbycJ3swYGJ8b0oNeaSTpojCN+Lw==.638061485086019275; path=/; secure; HttpOnly; SameSite=Lax,__Host-www.server-daten.de.SSNone=GVWFS7lHMU+7J/ZvEFTVYsBMGLAaEnJJk3qWS5XGngO7LAOKOjwMS4idmfoYcYONMOcUi0G1kxhcGdbAvF2DLX1KVOAdgUBi8fTzE8HXFN3H2TxY+mIOzO6VTRRbycJ3swYGJ8b0oNeaSTpojCN+Lw==.638061485086019275; path=/; secure; HttpOnly; SameSite=None
Date: Fri, 09 Dec 2022 01:08:28 GMT
Connection: close
Content-Length: 1724

• https://www.server-daten.de/
GZip used - 1724 / 3174 - 45.68 %
Inline-JavaScript (∑/total): 0/0 Inline-CSS (∑/total): 0/0
200

Html is minified: 100.57 %
2.434
A
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
P3P: CP="NOI CUR OUR STA"
Referrer-Policy: strict-origin
Permissions-Policy: camera=(self)
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self'; connect-src 'self'; child-src 'self'; frame-src 'self'; frame-ancestors 'self'; base-uri 'self'; ; report-uri /-cspr.html
Set-Cookie: __Host-www.server-daten.de=zfWjYRf2OEW8jZG4o93Whu8cX6DLfH1EhFusJZBGa4bVInXEBTx/TJMMwGGNT5vpMxn+Vh77wZ5gy60gtyT2qszttOukoEcQogArNpWkwydTLNaStRximRgYyandK3RJYyVG2X/NCaZ9pQXfkZzmSw==.638061485160677460; path=/; secure; HttpOnly; SameSite=Lax,__Host-www.server-daten.de.SSNone=zfWjYRf2OEW8jZG4o93Whu8cX6DLfH1EhFusJZBGa4bVInXEBTx/TJMMwGGNT5vpMxn+Vh77wZ5gy60gtyT2qszttOukoEcQogArNpWkwydTLNaStRximRgYyandK3RJYyVG2X/NCaZ9pQXfkZzmSw==.638061485160677460; path=/; secure; HttpOnly; SameSite=None
Date: Fri, 09 Dec 2022 01:08:35 GMT
Connection: close
Content-Length: 1724

• http://2a01:238:301b::1226/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
2a01:238:301b::1226
Inline-JavaScript (∑/total): 0/0 Inline-CSS (∑/total): 0/0
404

Html is minified: 100.00 %
0.026
A
Not Found
Visible Content: No such page
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
Date: Fri, 09 Dec 2022 01:08:31 GMT
Connection: close
Content-Length: 38

• https://[2a01:0238:301b:0000:0000:0000:0000:1226]/
2a01:238:301b::1226
200

2.430
N
Certificate error: RemoteCertificateNameMismatch
small visible content (num chars: 0)
Content-Type: text/html; charset=utf-8
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
P3P: CP="NOI CUR OUR STA"
Referrer-Policy: strict-origin
Permissions-Policy: camera=(self)
Content-Security-Policy: default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; script-src 'self'; connect-src 'self'; child-src 'self'; frame-ancestors https: ; form-action 'self'; base-uri 'self'; report-uri /-cspr.html
Date: Fri, 09 Dec 2022 01:08:31 GMT
Connection: close
Content-Length: 0

7. Comments


1. General Results, most used to calculate the result

Aname "2a01:238:301b::1226" is ipv6 address, public suffix is not defined
AGood: All ip addresses are public addresses
AGood: destination is https
AGood: No cookie sent via http.
AGood: every cookie sent via https is marked as secure
AGood: Every cookie has a SameSite Attribute with a correct value Strict/Lax/None
AExcellent: All cookies (except Cloudflare __cfduid) are Prefix-Cookies:4 Cookies complete, 4 __Host-Cookies, 0 __Secure-Cookies, 0 __cfduid-Cookies (Cloudflare)
AGood: every https has a Strict Transport Security Header
AGood: HSTS max-age is long enough, 63072000 seconds = 730 days
AGood: HSTS has includeSubdomains - directive
AGood: HSTS has preload directive
Warning: HSTS preload sent, but not in Preload-List. Never send a preload directive if you don't know what preload means. Check https://hstspreload.org/ to learn the basics about the Google-Preload list. If you send a preload directive, you should **immediately** add your domain to the HSTS preload list via https://hstspreload.org/ . If Google accepts the domain, so the status is "pending": Note that new entries are hardcoded into the Chrome source code and can take several months before they reach the stable version. So you will see this message some months. If you don't want that or if you don't understand "preload", but if you send a preload directive and if you have correct A-redirects, everybody can add your domain to that list. Then you may have problems, it's not easy to undo that. So if you don't want your domain preloaded, remove the preload directive.
AGood: All urls with http status 200/404 have a complete Content-Type header (MediaType / MediaSubType + correct charset)
Nhttps://[2a01:0238:301b:0000:0000:0000:0000:1226]/ 2a01:238:301b::1226
200

Error - Certificate isn't trusted, RemoteCertificateNameMismatch
BNo _mta-sts TXT record found (mta-sts: Mail Transfer Agent Strict Transport Security - see RFC 8461). Read the result of server-daten.de (Url-Checks, Comments, Connections and DomainServiceRecords) to see a complete definition. Domainname: _mta-sts.2a01:238:301b::1226

2. Header-Checks (alpha, started 2022-10-23, may be buggy / incomplete)

Awww.server-daten.de
Content-Security-Policy
Ok: Header without syntax errors found: default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self'; connect-src 'self'; child-src 'self'; frame-src 'self'; frame-ancestors 'self'; base-uri 'self'; ; report-uri /-cspr.html
B

Info: Header-Element is deprecated. report-uri /-cspr.html
A

Good: default-src directive only with 'none' or 'self', additional sources are blocked.
A

Good: default-src without 'unsafe-inline' or 'unsave-eval'.
E

Bad: No form-action directive found. Use one to limit the form - action - destinations. form-action is a navigation-directive, so default-src isn't used.
A

Good: frame-ancestors directive found. That limits pages who are allowed to use this page in a frame / iframe / object / embed / applet. frame-ancestors is a navigation-directive, so default-src isn't used.
A

Good: base-uri directive found. That limits the URLs which can be used in a document's <base> element. Because it's a document directive, default-src isn't used, so an own directive is required.
A

Good: No object-src found, but the default-src used as fallback is defined and restricted.
A

Good: script-src without 'unsafe-inline' and 'unsafe-eval' found. That's the recommended configuration.
A

Good: script-src without * and a scheme found.
A

Good: script-src without data: schema found. Why is this important? The data: schema allows hidden code injection. Insert <script src='data:application/javascript;base64,YWxlcnQoJ1hTUycpOw=='></script> in your page and see what happens.
A

Good: frame-src without data: defined or frame-src missing and the default-src used as fallback not allows the data: schema. That blocks hidden code injection. Insert <iframe src="data:text/html;charset=utf-8;base64,PCFET0NUWVBFIGh0bWw+PGh0bWw+PGJvZHk+PHA+YmVmb3JlPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPmFsZXJ0KCdYU1MnKTwvc2NyaXB0PjxwPmFmdGVyPC9ib2R5PjwvaHRtbD4="></iframe> in your page and see what happens.
A
X-Content-Type-Options
Ok: Header without syntax errors found: nosniff
A
Referrer-Policy
Ok: Header without syntax errors found: strict-origin
A
Permissions-Policy
Ok: Header without syntax errors found: camera=(self)
A
X-Frame-Options
Ok: Header without syntax errors found: SAMEORIGIN
B

Info: Header is deprecated. May not longer work in modern browsers. SAMEORIGIN. Better solution: Use a Content-Security-Policy Header with a frame-ancestors directive. DENY - use 'none', SAMEORIGIN - use 'self'. If you want to allow some domains to frame your page, add these urls.
A
X-Xss-Protection
Ok: Header without syntax errors found: 1; mode=block
B

Info: Header is deprecated. May not longer work in modern browsers. 1; mode=block
Awww.server-daten.de 2a01:238:301b::1226
Content-Security-Policy
Ok: Header without syntax errors found: default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self'; connect-src 'self'; child-src 'self'; frame-src 'self'; frame-ancestors 'self'; base-uri 'self'; ; report-uri /-cspr.html
B

Info: Header-Element is deprecated. report-uri /-cspr.html
A

Good: default-src directive only with 'none' or 'self', additional sources are blocked.
A

Good: default-src without 'unsafe-inline' or 'unsave-eval'.
E

Bad: No form-action directive found. Use one to limit the form - action - destinations. form-action is a navigation-directive, so default-src isn't used.
A

Good: frame-ancestors directive found. That limits pages who are allowed to use this page in a frame / iframe / object / embed / applet. frame-ancestors is a navigation-directive, so default-src isn't used.
A

Good: base-uri directive found. That limits the URLs which can be used in a document's <base> element. Because it's a document directive, default-src isn't used, so an own directive is required.
A

Good: No object-src found, but the default-src used as fallback is defined and restricted.
A

Good: script-src without 'unsafe-inline' and 'unsafe-eval' found. That's the recommended configuration.
A

Good: script-src without * and a scheme found.
A

Good: script-src without data: schema found. Why is this important? The data: schema allows hidden code injection. Insert <script src='data:application/javascript;base64,YWxlcnQoJ1hTUycpOw=='></script> in your page and see what happens.
A

Good: frame-src without data: defined or frame-src missing and the default-src used as fallback not allows the data: schema. That blocks hidden code injection. Insert <iframe src="data:text/html;charset=utf-8;base64,PCFET0NUWVBFIGh0bWw+PGh0bWw+PGJvZHk+PHA+YmVmb3JlPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPmFsZXJ0KCdYU1MnKTwvc2NyaXB0PjxwPmFmdGVyPC9ib2R5PjwvaHRtbD4="></iframe> in your page and see what happens.
A
X-Content-Type-Options
Ok: Header without syntax errors found: nosniff
A
Referrer-Policy
Ok: Header without syntax errors found: strict-origin
A
Permissions-Policy
Ok: Header without syntax errors found: camera=(self)
A
X-Frame-Options
Ok: Header without syntax errors found: SAMEORIGIN
B

Info: Header is deprecated. May not longer work in modern browsers. SAMEORIGIN. Better solution: Use a Content-Security-Policy Header with a frame-ancestors directive. DENY - use 'none', SAMEORIGIN - use 'self'. If you want to allow some domains to frame your page, add these urls.
A
X-Xss-Protection
Ok: Header without syntax errors found: 1; mode=block
B

Info: Header is deprecated. May not longer work in modern browsers. 1; mode=block

3. DNS- and NameServer - Checks


4. Content- and Performance-critical Checks

AGood: All checks /.well-known/acme-challenge/random-filename without redirects answer with the expected http status 404 - Not Found. Creating a Letsencrypt certificate via http-01 challenge should work. If it doesn't work: Check your vHost configuration (apachectl -S, httpd -S, nginx -T). Every combination of port and ServerName / ServerAlias (Apache) or Server (Nginx) must be unique. Merge duplicated entries in one vHost. If you use an IIS, extensionless files must be allowed in the /.well-known/acme-challenge subdirectory. Create a web.config in that directory. Content: <configuration><system.webServer><staticContent><mimeMap fileExtension="." mimeType="text/plain" /></staticContent></system.webServer></configuration>. If you have a redirect http ⇒ https, that's ok, Letsencrypt follows such redirects to port 80 / 443 (same or other server). There must be a certificate. But the certificate may be expired, self signed or with a not matching domain name. Checking the validation file Letsencrypt ignores such certificate errors. Trouble creating a certificate? Use https://community.letsencrypt.org/ to ask.
AGood: Every https result with status 200 supports GZip.
AGood: Every https result with status 200 has a minified Html-Content with a quota lower then 110 %.
AGood: Every https connection via port 443 supports the http/2 protocol via ALPN.
AGood: All script Elements (type text/javascript) and src-Attribute have a defer / async - Attribute. So loading and executing these JavaScripts doesn't block parsing and rendering the Html-Output.
AGood: All CSS / JavaScript files are sent with GZip. That reduces the content of the files. 4 external CSS / JavaScript files found
AGood: All images with internal compression not sent via GZip. Images (.png, .jpg) are already compressed, so an additional GZip isn't helpful. 2 images (type image/png, image/jpg) found without additional GZip. Not required because these images are already compressed
AGood: All CSS / JavaScript files are sent with a long Cache-Control header (minimum 7 days). So the browser can re-use these files, no download is required. 4 external CSS / JavaScript files with long Cache-Control max-age found
AGood: All images are sent with a long Cache-Control header (minimum 7 days). So the browser can reuse these files, no download is required. 2 image files with long Cache-Control max-age found
AGood: All checked attribute values are enclosed in quotation marks (" or ').
AGood: All img-elements have a valid alt-attribute.: 2 img-elements found.
ADuration: 51544 milliseconds, 51.544 seconds


8. Connections

DomainIPPortCert.ProtocolKeyExchangeStrengthCipherStrengthHashAlgorithmOCSP stapling
Domain/KeyExchangeIP/StrengthPort/CipherCert./StrengthProtocol/HashAlgorithmOCSP stapling
www.server-daten.de
www.server-daten.de
443
ok
Tls12
ECDH Ephermal
384
Aes256
256
Sha384
supported
ok
www.server-daten.de
www.server-daten.de
443
ok
Tls12

ECDH Ephermal
384
Aes256
256
Sha384
supported
ok
http/2 via ALPN supported 
Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2
http/2 via ALPN supported
Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2
Chain (complete)
1CN=*.server-daten.de

2CN=R3, O=Let's Encrypt, C=US


www.server-daten.de
2a01:238:301b::1226
443
ok
Tls12
ECDH Ephermal
384
Aes256
256
Sha384
supported
ok

www.server-daten.de
2a01:238:301b::1226
443
ok
Tls12

ECDH Ephermal
384
Aes256
256
Sha384
supported
ok
http/2 via ALPN supported 
No SNI required - domain included in main certificate
Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2
http/2 via ALPN supported
No SNI required - domain included in main certificate
Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2
Chain (complete)
1CN=*.server-daten.de

2CN=R3, O=Let's Encrypt, C=US


[2a01:0238:301b:0000:0000:0000:0000:1226]
2a01:238:301b::1226
443
name does not match
Tls12
ECDH Ephermal
384
Aes256
256
Sha384
supported
ok

[2a01:0238:301b:0000:0000:0000:0000:1226]
2a01:238:301b::1226
443
name does not match
Tls12

ECDH Ephermal
384
Aes256
256
Sha384
supported
ok
http/2 via ALPN supported 
Cert sent without SNI
Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2
http/2 via ALPN supported
Cert sent without SNI
Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2
Chain (complete)
1CN=*.server-daten.de

2CN=R3, O=Let's Encrypt, C=US


9. Certificates

1.
1.
CN=*.server-daten.de
18.11.2022
16.02.2023
40 days expired
*.server-daten.de, server-daten.de - 2 entries
1.
1.
CN=*.server-daten.de
18.11.2022

16.02.2023
40 days expired
*.server-daten.de, server-daten.de - 2 entries

KeyalgorithmEC Public Key (384 bit, secp384r1)
Signatur:SHA256 With RSA-Encryption
Serial Number:03C30E2025156A10BCAF2DBC1FE501FA5668
Thumbprint:34970850239F4B5D7D5114AD741DF19D81B4974C
SHA256 / Certificate:6eIfu5jI9HEl4eTdHjdLBdw67XAjhdR6JVevE72xHsc=
SHA256 hex / Cert (DANE * 0 1):e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):936ea23f4e85a52cba5662e27888272c975ed46e39f7758082bb1ad5bce79f12
SHA256 hex / Subject Public Key Information (SPKI):936ea23f4e85a52cba5662e27888272c975ed46e39f7758082bb1ad5bce79f12 (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:Check unknown. No result 404 / 200
OCSP - Url:http://r3.o.lencr.org
OCSP - must staple:no
Certificate Transparency:yes
Enhanced Key Usage:Serverauthentifizierung (1.3.6.1.5.5.7.3.1), Clientauthentifizierung (1.3.6.1.5.5.7.3.2)


2.
CN=R3, O=Let's Encrypt, C=US
04.09.2020
15.09.2025
expires in 902 days


2.
CN=R3, O=Let's Encrypt, C=US
04.09.2020

15.09.2025
expires in 902 days


KeyalgorithmRSA encryption (2048 bit)
Signatur:SHA256 With RSA-Encryption
Serial Number:00912B084ACF0C18A753F6D62E25A75F5A
Thumbprint:A053375BFE84E8B748782C7CEE15827A6AF5A405
SHA256 / Certificate:Z63RFmsCCuYbj1/JaBPATCqliZYHloZVcqPH5zdhPf0=
SHA256 hex / Cert (DANE * 0 1):e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):8d02536c887482bc34ff54e41d2ba659bf85b341a0a20afadb5813dcfbcf286d
SHA256 hex / Subject Public Key Information (SPKI):8d02536c887482bc34ff54e41d2ba659bf85b341a0a20afadb5813dcfbcf286d
SPKI checked via https://v1.pwnedkeys.com/spki-hash:Check unknown. No result 404 / 200
OCSP - Url:
OCSP - must staple:no
Certificate Transparency:no
Enhanced Key Usage:Clientauthentifizierung (1.3.6.1.5.5.7.3.2), Serverauthentifizierung (1.3.6.1.5.5.7.3.1)


3.
CN=ISRG Root X1, O=Internet Security Research Group, C=US
04.06.2015
04.06.2035
expires in 4451 days


3.
CN=ISRG Root X1, O=Internet Security Research Group, C=US
04.06.2015

04.06.2035
expires in 4451 days


KeyalgorithmRSA encryption (4096 bit)
Signatur:SHA256 With RSA-Encryption
Serial Number:008210CFB0D240E3594463E0BB63828B00
Thumbprint:CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA256 / Certificate:lrzsBiZJdvN0YHeazyjFp8/oo8Cq4RqP/O4FwL3fCMY=
SHA256 hex / Cert (DANE * 0 1):96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
SHA256 hex / PublicKey (DANE * 1 1):0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3
SHA256 hex / Subject Public Key Information (SPKI):0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3
SPKI checked via https://v1.pwnedkeys.com/spki-hash:Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:no
Certificate Transparency:no
Enhanced Key Usage:



10. Last Certificates - Certificate Transparency Log Check

1. Source CertSpotter - active certificates (one check per day)

No CertSpotter - CT-Log entries found


2. Source crt.sh - old and new certificates, sometimes very slow - only certificates with "not after" > of the last months are listed

No CRT - CT-Log entries found


11. Html-Content - Entries

Summary

Subresource Integrity (SRI)
DomainnameHtmlElementrel/property∑ size∑ problems∑ int.∑ ext.∑ Origin poss.∑ SRI ParseErrors∑ SRI valid∑ SRI missing
https://2a01:238:301b::1226/
2a01:238:301b::1226
a

11

0


0
0
0


img

1
3,121 Bytes
0
1
0
0
0
0


link
stylesheet
1
2,385 Bytes
0
1
0
0
0
1


link
other
1
728 Bytes
0
1
0
0
0
0


meta
other
2

0


0
0
0


script

1
11,673 Bytes
0
1
0
0
0
1

https://www.server-daten.de/
a

11

0


0
0
0


img

1
3,121 Bytes
0
1
0
0
0
0


link
stylesheet
1
2,385 Bytes
0
1
0
0
0
1


link
other
1
728 Bytes
0
1
0
0
0
0


meta
other
2

0


0
0
0


script

1
11,673 Bytes
0
1
0
0
0
1

Details

DomainnameHtml-Elementname/equiv/ property/relhref/src/contentHttpStatusmsgStatus
https://2a01:238:301b::1226/
2a01:238:301b::1226
a

/admin/


1
ok








a

/admin/upload.aspx


1
ok








a

/confirm/


1
ok








a

/linkcheck/


1
ok








a

https://www.sql-und-xml.de/


2
ok








a

https://www.sql-und-xml.de/server-daten/


2
ok








a

https://www.sql-und-xml.de/server-daten/datenschutz.html#cookies


1
ok








a

mailto:info@sql-und-xml.de


1
ok








a

tel:+493042020060


1
ok








img
src
/images/server-daten.png
200

1
ok
alt: server-daten: Relationale Web-Datenbanken zum Mietenimage/png, X-Content-Type-Options nosniff found

Cache-Control: max-age=31536000 with long duration found.
No GZip - 3121 Bytes






link
shortcut icon
/favicon.ico
200

1
ok
image/x-icon, X-Content-Type-Options nosniff found

Cache-Control: max-age=31536000 with long duration found.
GZip: 728/2238 Bytes






link
stylesheet
/admin/sd.20221101153522.css
200

1
ok
text/css; charset=utf-8, X-Content-Type-Options nosniff found

Cache-Control: max-age=31536000 - with long duration found.
GZip: 2385/7344 Bytes




SRI found. Integrity:
sha384-1uoTG3lBy+/fdwb+O1tLphRiOCpwJ+vlOoIwG2MS4xZ55qW5pZMTBWWuSEEZVQjo
crossorigin: anonymous
No SRI Parse errorvalid



meta
content-type
text/html; charset=utf-8


1
ok








meta
robots
index,follow


1
ok








script
src
/admin/sd.csp.20210927144047.js
200

1
ok
defer attribute found text/javascript; charset=utf-8, X-Content-Type-Options nosniff found

Cache-Control: max-age=31536000 - with long duration found.
GZip: 11673/53850 Bytes




SRI found. Integrity:
sha384-Jgf4ytX2g2ra63dVNv/vDzHwi8kZADt9fak8DK2pFdvIfNxxN75sp9IlzjY32UVi
crossorigin: anonymous
No SRI Parse errorvalid


https://www.server-daten.de/

a

/admin/


1
ok








a

/admin/upload.aspx


1
ok








a

/confirm/


1
ok








a

/linkcheck/


1
ok








a

https://www.sql-und-xml.de/


2
ok








a

https://www.sql-und-xml.de/server-daten/


2
ok








a

https://www.sql-und-xml.de/server-daten/datenschutz.html#cookies


1
ok








a

mailto:info@sql-und-xml.de


1
ok








a

tel:+493042020060


1
ok








img
src
/images/server-daten.png
200

1
ok
alt: server-daten: Relationale Web-Datenbanken zum Mietenimage/png, X-Content-Type-Options nosniff found

Cache-Control: max-age=31536000 with long duration found.
No GZip - 3121 Bytes






link
shortcut icon
/favicon.ico
200

1
ok
image/x-icon, X-Content-Type-Options nosniff found

Cache-Control: max-age=31536000 with long duration found.
GZip: 728/2238 Bytes






link
stylesheet
/admin/sd.20221101153522.css
200

1
ok
text/css; charset=utf-8, X-Content-Type-Options nosniff found

Cache-Control: max-age=31536000 - with long duration found.
GZip: 2385/7344 Bytes




SRI found. Integrity:
sha384-1uoTG3lBy+/fdwb+O1tLphRiOCpwJ+vlOoIwG2MS4xZ55qW5pZMTBWWuSEEZVQjo
crossorigin: anonymous
No SRI Parse errorvalid



meta
content-type
text/html; charset=utf-8


1
ok








meta
robots
index,follow


1
ok








script
src
/admin/sd.csp.20210927144047.js
200

1
ok
defer attribute found text/javascript; charset=utf-8, X-Content-Type-Options nosniff found

Cache-Control: max-age=31536000 - with long duration found.
GZip: 11673/53850 Bytes




SRI found. Integrity:
sha384-Jgf4ytX2g2ra63dVNv/vDzHwi8kZADt9fak8DK2pFdvIfNxxN75sp9IlzjY32UVi
crossorigin: anonymous
No SRI Parse errorvalid



12. Nameserver - IP-Adresses

Required Root-climbing DNS-Queries to find ip addresses of all Name Servers:


No NameServer - IP address - Informations found


13. CAA - Entries

No CAA entries found


14. TXT - Entries

No TXT entries found


15. DomainService - Entries (SSHFP Check is new - 2022-09-24, may be incomplete, alpha, some results are required)

No DomainServiceEntries entries found



16. Cipher Suites

DomainIPPortCipher (OpenSsl / IANA)
www.server-daten.de
2a01:238:301b::1226
443
ECDHE-ECDSA-AES256-GCM-SHA384
(Recommended)
TLSv1.2
0xC0,0x2C
FS
4 Ciphers, 22.57 sec
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
ECDH
ECDSA
AESGCM(256)
AEAD



ECDHE-ECDSA-AES128-GCM-SHA256
(Recommended)
TLSv1.2
0xC0,0x2B
FS

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
ECDH
ECDSA
AESGCM(128)
AEAD



ECDHE-ECDSA-AES256-SHA384
(Weak)
TLSv1.2
0xC0,0x24
FS

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
ECDH
ECDSA
AES(256)
SHA384



ECDHE-ECDSA-AES128-SHA256
(Weak)
TLSv1.2
0xC0,0x23
FS

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
ECDH
ECDSA
AES(128)
SHA256


17. Portchecks

No open Ports <> 80 / 443 found, so no additional Ports checked.



Permalink: https://check-your-website.server-daten.de/?i=8656c400-c508-4ec1-a0b8-d1d2c4ae3186


Last Result: https://check-your-website.server-daten.de/?q=%5b2a01%3a238%3a301b%3a%3a1226%5d&h=www.server-daten.de - 2022-12-09 02:08:24


Do you like this page? Support this tool, add a link on your page:

<a href="https://check-your-website.server-daten.de/?q=%5b2a01%3a238%3a301b%3a%3a1226%5d&h=www.server-daten.de" target="_blank">Check this Site: [2a01:238:301b::1226]</a>

Do you really want to support this project? Donate: Check-your-website, IBAN DE98 1001 0010 0575 2211 07, SWIFT/BIC PBNKDEFF, Euro