default-src 'self' 'unsafe-inline' www.youtube-nocookie.com www.google-analytics.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' code.jquery.com stackpath.bootstrapcdn.com cdn.jsdelivr.net www.googletagmanager.com tagmanager.google.com tag.aticdn.net www.gstatic.com cdnjs.cloudflare.com js/intlTelInput.js www.google.com static.hotjar.com script.hotjar.com static.hotjar.com/c/hotjar-3253247.js script.hotjar.com/modules.bd615e91f206bba6c106.js cdn.plot.ly unpkg.com/bootstrap-table@1.22.3/dist/bootstrap-table.min.js platform.twitter.com run.pstmn.io/button.js; object-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' use.typekit.net stackpath.bootstrapcdn.com www.googletagmanager.com cdn.jsdelivr.net maxcdn.bootstrapcdn.com p.typekit.net fonts.googleapis.com tagmanager.google.com ton.twimg.com www.gstatic.com/charts/ css/intlTelInput.css static.hotjar.com script.hotjar.com cdnjs.cloudflare.com static.piste.gouv.fr unpkg.com/bootstrap-table@1.22.3/dist/bootstrap-table.min.css; img-src 'self' 'unsafe-inline' data: i.ytimg.com www.googletagmanager.com pbs.twimg.com logs1412.xiti.com www.google-analytics.com/g/collect static.hotjar.com script.hotjar.com cdn.jsdelivr.net static.piste.gouv.fr *.esante.gouv.fr; media-src 'self' 'unsafe-inline'; frame-src 'self' www.youtube-nocookie.com www.youtube.com view.genial.ly www.google.com vars.hotjar.com view.genially.com platform.twitter.com www.facebook.com; child-src 'self' www.youtube-nocookie.com; font-src 'self' 'unsafe-inline' use.typekit.net *.bootstrapcdn.com cdn.jsdelivr.net themes.googleusercontent.com fonts.gstatic.com data: script.hotjar.com cdnjs.cloudflare.com; connect-src 'self' logs1412.xiti.com www.google-analytics.com/g/collect *.hotjar.com *.hotjar.io wss://*.hotjar.com api.digitalcx.com cdn.plot.ly www.googletagmanager.com www.google.com; upgrade-insecure-requests

Diagnostics

Metrics

smtp

time

whois

domain

http

hosts2-ns

xfer

mit-ml-dev

kerberos-sec

su-mit-tg

dnsix

metagram

newacct

pop3

nntp

msrpc

netbios-ssn

imap

914c-g

anet

ldap

https

snpp

smtps

isakmp

klogin

rtsp

submission

ldapssl

multiling-http

spamassassin

mdbs_daemon

device

ccproxy-http

unknown

accessbuilder

omginitialrefs

ftps

imaps

pop3s

garcon

cadlock

webpush

windows-icfw

surf

exp2

netvenuechat

NFS-or-IIS

ms-lsa

iad2

iad3

netinfo

zincite-a

mtqp

java-or-OTGfileshare

optima-vnet

brvread

kiosk

veracity

kyoceranetdev

syscomlan

fpo-fns

instl_boots

instl_bootc

cognex-insight

cardax

warmspotMgmt

socks

pvuniwien

amt-esd-prot

ansoft-lm-1

cplscrambler-al

ratio-adp

lmsocialserver

rmpp

fnet-remote-ui

dossier

llsurfup-http

catchpole

mysql-cluster

alias

caids-sensor

cajo-discovery

dmidi

nucleus-sand

hotline

lotusnotes

ms-sql-s

ms-sql-m

SPF Record - Detection

A DNS TXT record was detected. The TXT record lets a domain admin leave notes on a DNS server.

DNS TXT Record Detected

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

DNS DMARC - Detect

An NS record was detected. An NS record delegates a subdomain to a set of name servers.

NS Record Detection

An email service was detected. Check the email service or spam filter that is used for a domain.

Email Service Detector

An MX record was detected. MX records direct emails to a mail exchange server.

MX Record Detection

A DKIM (DomainKeys Identified Mail) TXT record was detected. DKIM is an email authentication method that allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.


DKIM Record - Detection

Identified cookies that lacked the samesite=strict attribute, which prevented enforcement of restrictions on cross-domain cookie transmission.


Missing Cookie SameSite Strict

Wappalyzer Technology Detection

Microsoft Azure Domain Tenant ID was detected.

Microsoft Azure Domain Tenant ID - Detect

RDAP (Registration Data Access Protocol) is a standard defined by the IETF to replace the whois protocol
in queries for information about Internet resource records such as domain names, IP addresses, and ASNs.


RDAP WHOIS

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

Checks a sites certificate to see if there are wildcard CN or SAN entries.


Wildcard TLS Certificate

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

incap_ses_608_3314458

visid_incap_3314458

___utmvc

personnaliser_les_cookies

Websites that have a shopping cart or checkout page, either using a known ecommerce platform or a custom solution.

Cart Functionality

Drupal is a free and open-source web content management framework.

Drupal

PHP is a general-purpose scripting language used for web development.

Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.

Firebase

Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.

Bootstrap

Apache is a free and open-source cross-platform web server software.

Apache HTTP Server

Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

Cloudflare

Typekit is an online service which offers a subscription library of fonts.

Typekit

Tiny Slider is a vanilla javascript slider for all purposes.

Tiny Slider

Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.

Google Tag Manager

cdnjs is a free distributed JS library delivery service.

cdnjs

Microsoft Advertising is an online advertising platform developed by Microsoft.

Microsoft Advertising

jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.

jQuery UI

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

Hotjar is a suite of analytic tools to assist in the gathering of qualitative data, providing feedback through tools such as heatmaps, session recordings, and surveys.

Hotjar

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

reCAPTCHA

Microsoft 365 is a line of subscription services offered by Microsoft as part of the Microsoft Office product line.

Microsoft 365

Imperva is a cyber security software and services company for networking, data, and application security.

Imperva

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.

Popper

Open Graph is a protocol that is used to integrate any web page into the social graph.

Open Graph

ZAP warnings logged - see the zap.log file for details

Percentage of responses with status code 2xx

Percentage of responses with status code 3xx

Percentage of responses with status code 4xx

Percentage of endpoints with content type application/javascript

Percentage of endpoints with content type application/pdf

Percentage of endpoints with content type application/xml

Percentage of endpoints with content type image/jpeg

Percentage of endpoints with content type image/png

Percentage of endpoints with content type text/css

Percentage of endpoints with content type text/html

Percentage of endpoints with content type text/javascript

Percentage of endpoints with content type text/markdown

Percentage of endpoints with content type text/plain

type	url	details
unknown	use.typekit.net/jjx2ksb.c...
cloudflare	cdnjs.cloudflare.com/ajax...	Host files locally
hotjar	static.hotjar.com/c/hotja...	Dont use HotJar
unknown	p.typekit.net/p.css?s=1&k...
unknown	use.typekit.net/af/9b05f3...
unknown	use.typekit.net/af/2cd6bf...
unknown	use.typekit.net/af/c4c302...
unknown	use.typekit.net/af/053fc9...
unknown	use.typekit.net/af/9b05f3...
unknown	use.typekit.net/af/2cd6bf...
unknown	use.typekit.net/af/c4c302...
unknown	use.typekit.net/af/053fc9...
google tag manager	www.googletagmanager.com/...	Use hosted Matomo instance

flag	country	hostname	ip	city
	États-Unis	esante.gouv.fr	45.60.130.134	?
	États-Unis	use.typekit.net	23.215.0.137	Ashburn
	?	cdnjs.cloudflare.com	104.17.24.14	?
	États-Unis	static.hotjar.com	18.160.41.53	Seattle
	États-Unis	p.typekit.net	23.199.55.15	Ashburn
	États-Unis	www.googletagmanager.com	172.253.139.97	?

https://esante.gouv.fr

LightHouse

https://esante.gouv.fr/environ 3 heures

Système de design de l'état

Eco-index

GES: 1.96 gramme(s) par visite

Eau : 2.94 cl par visite

Ça veut dire quoi ?

Cookies4 jours

Scripts tiers4 jours

Déclaration de mise en accessibilité

Conformité partielle

name	domain	httpOnly	secure
incap_ses_608_3314458	.esante.gouv.fr	❌	❌
visid_incap_3314458	.esante.gouv.fr	✔️	❌
___utmvc	esante.gouv.fr	❌	❌
personnaliser_les_cookies	esante.gouv.fr	❌	✔️