default-src 'self' 'unsafe-inline' www.youtube-nocookie.com www.google-analytics.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' code.jquery.com stackpath.bootstrapcdn.com cdn.jsdelivr.net www.googletagmanager.com tagmanager.google.com tag.aticdn.net www.gstatic.com cdnjs.cloudflare.com js/intlTelInput.js www.google.com static.hotjar.com script.hotjar.com static.hotjar.com/c/hotjar-3253247.js script.hotjar.com/modules.bd615e91f206bba6c106.js cdn.plot.ly unpkg.com/bootstrap-table@1.22.3/dist/bootstrap-table.min.js platform.twitter.com run.pstmn.io/button.js; object-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' use.typekit.net stackpath.bootstrapcdn.com www.googletagmanager.com cdn.jsdelivr.net maxcdn.bootstrapcdn.com p.typekit.net fonts.googleapis.com tagmanager.google.com ton.twimg.com www.gstatic.com/charts/ css/intlTelInput.css static.hotjar.com script.hotjar.com cdnjs.cloudflare.com static.piste.gouv.fr unpkg.com/bootstrap-table@1.22.3/dist/bootstrap-table.min.css; img-src 'self' 'unsafe-inline' data: i.ytimg.com www.googletagmanager.com pbs.twimg.com logs1412.xiti.com www.google-analytics.com/g/collect static.hotjar.com script.hotjar.com cdn.jsdelivr.net static.piste.gouv.fr *.esante.gouv.fr; media-src 'self' 'unsafe-inline'; frame-src 'self' www.youtube-nocookie.com www.youtube.com view.genial.ly www.google.com vars.hotjar.com view.genially.com platform.twitter.com www.facebook.com copilotstudio.microsoft.com; child-src 'self' www.youtube-nocookie.com; font-src 'self' 'unsafe-inline' use.typekit.net *.bootstrapcdn.com cdn.jsdelivr.net themes.googleusercontent.com fonts.gstatic.com data: script.hotjar.com cdnjs.cloudflare.com; connect-src 'self' logs1412.xiti.com www.google-analytics.com/g/collect *.hotjar.com *.hotjar.io wss://*.hotjar.com api.digitalcx.com cdn.plot.ly; upgrade-insecure-requests

Diagnostics

Metrics

http

https

NFS-or-IIS

LSA-or-nterm

SPF Record - Detection

A DNS TXT record was detected. The TXT record lets a domain admin leave notes on a DNS server.

DNS TXT Record Detected

DNS DMARC - Detect

An email service was detected. Check the email service or spam filter that is used for a domain.

Email Service Detector

An MX record was detected. MX records direct emails to a mail exchange server.

MX Record Detection

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

An NS record was detected. An NS record delegates a subdomain to a set of name servers.

NS Record Detection

A DKIM (DomainKeys Identified Mail) TXT record was detected. DKIM is an email authentication method that allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.


DKIM Record - Detection

Identified cookies that lacked the samesite=strict attribute, which prevented enforcement of restrictions on cross-domain cookie transmission.


Missing Cookie SameSite Strict

Wappalyzer Technology Detection

Microsoft Azure Domain Tenant ID was detected.

Microsoft Azure Domain Tenant ID - Detect

RDAP (Registration Data Access Protocol) is a standard defined by the IETF to replace the whois protocol
in queries for information about Internet resource records such as domain names, IP addresses, and ASNs.


RDAP WHOIS

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

Checks a sites certificate to see if there are wildcard CN or SAN entries.


Wildcard TLS Certificate

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

___utmvc

visid_incap_3314458

incap_ses_608_3314458

personnaliser_les_cookies

Websites that have a shopping cart or checkout page, either using a known ecommerce platform or a custom solution.

Cart Functionality

Drupal is a free and open-source web content management framework.

Drupal

PHP is a general-purpose scripting language used for web development.

Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.

Firebase

Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.

Bootstrap

Apache is a free and open-source cross-platform web server software.

Apache HTTP Server

Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

Cloudflare

Typekit is an online service which offers a subscription library of fonts.

Typekit

Tiny Slider is a vanilla javascript slider for all purposes.

Tiny Slider

Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.

Google Tag Manager

cdnjs is a free distributed JS library delivery service.

cdnjs

Microsoft Advertising is an online advertising platform developed by Microsoft.

Microsoft Advertising

jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.

jQuery UI

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

Hotjar is a suite of analytic tools to assist in the gathering of qualitative data, providing feedback through tools such as heatmaps, session recordings, and surveys.

Hotjar

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

reCAPTCHA

Microsoft 365 is a line of subscription services offered by Microsoft as part of the Microsoft Office product line.

Microsoft 365

Imperva is a cyber security software and services company for networking, data, and application security.

Imperva

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.

Popper

Open Graph is a protocol that is used to integrate any web page into the social graph.

Open Graph

ZAP warnings logged - see the zap.log file for details

Percentage of responses with status code 2xx

Percentage of responses with status code 3xx

Percentage of responses with status code 4xx

Percentage of endpoints with content type application/javascript

Percentage of endpoints with content type application/pdf

Percentage of endpoints with content type application/xml

Percentage of endpoints with content type image/jpeg

Percentage of endpoints with content type image/png

Percentage of endpoints with content type text/css

Percentage of endpoints with content type text/html

Percentage of endpoints with content type text/javascript

Percentage of endpoints with content type text/markdown

Percentage of endpoints with content type text/plain

type	url	details
unknown	use.typekit.net/jjx2ksb.c...
cloudflare	cdnjs.cloudflare.com/ajax...	Host files locally
hotjar	static.hotjar.com/c/hotja...	Dont use HotJar
unknown	p.typekit.net/p.css?s=1&k...
unknown	use.typekit.net/af/9b05f3...
unknown	use.typekit.net/af/2cd6bf...
unknown	use.typekit.net/af/c4c302...
unknown	use.typekit.net/af/053fc9...
unknown	use.typekit.net/af/9b05f3...
unknown	use.typekit.net/af/2cd6bf...
unknown	use.typekit.net/af/c4c302...
unknown	use.typekit.net/af/053fc9...
google tag manager	www.googletagmanager.com/...	Use hosted Matomo instance
unknown	metrics.hotjar.io/?v=6&si...

flag	country	hostname	ip	city
	États-Unis	esante.gouv.fr	45.60.130.134	?
	États-Unis	use.typekit.net	23.215.0.142	Ashburn
	?	cdnjs.cloudflare.com	104.17.25.14	?
	États-Unis	static.hotjar.com	18.160.41.112	Seattle
	États-Unis	p.typekit.net	23.215.0.138	Ashburn
	États-Unis	www.googletagmanager.com	142.251.167.97	?
	Irlande	metrics.hotjar.io	52.212.177.191	Dublin

https://esante.gouv.fr

LightHouse

https://esante.gouv.fr/environ 3 heures

Système de design de l'état

Eco-index

GES: 1.94 gramme(s) par visite

Eau : 2.91 cl par visite

Ça veut dire quoi ?

Cookies1 jour

Scripts tiers1 jour

Déclaration de mise en accessibilité

Conformité partielle

name	domain	httpOnly	secure
___utmvc	esante.gouv.fr	❌	❌
visid_incap_3314458	.esante.gouv.fr	✔️	❌
incap_ses_608_3314458	.esante.gouv.fr	❌	❌
personnaliser_les_cookies	esante.gouv.fr	❌	✔️