content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

public-key-pinning

HTTP Public Key Pinning (HPKP) header not implemented

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

x-xss-protection

X-XSS-Protection header set to "1; mode=block"

default-src 'self' 'unsafe-inline' www.youtube-nocookie.com www.google-analytics.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' code.jquery.com stackpath.bootstrapcdn.com cdn.jsdelivr.net www.googletagmanager.com tagmanager.google.com tag.aticdn.net www.gstatic.com cdnjs.cloudflare.com js/intlTelInput.js www.google.com static.hotjar.com script.hotjar.com static.hotjar.com/c/hotjar-3253247.js script.hotjar.com/modules.bd615e91f206bba6c106.js; object-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' use.typekit.net stackpath.bootstrapcdn.com www.googletagmanager.com cdn.jsdelivr.net maxcdn.bootstrapcdn.com p.typekit.net fonts.googleapis.com tagmanager.google.com ton.twimg.com www.gstatic.com/charts/ css/intlTelInput.css static.hotjar.com script.hotjar.com cdnjs.cloudflare.com; img-src 'self' 'unsafe-inline' data: i.ytimg.com www.googletagmanager.com pbs.twimg.com logs1412.xiti.com www.google-analytics.com/g/collect static.hotjar.com script.hotjar.com cdn.jsdelivr.net; media-src 'self' 'unsafe-inline'; frame-src 'self' www.youtube-nocookie.com www.youtube.com view.genial.ly www.google.com vars.hotjar.com; child-src 'self' www.youtube-nocookie.com; font-src 'self' 'unsafe-inline' use.typekit.net *.bootstrapcdn.com cdn.jsdelivr.net themes.googleusercontent.com fonts.gstatic.com data: script.hotjar.com cdnjs.cloudflare.com; connect-src 'self' logs1412.xiti.com www.google-analytics.com/g/collect *.hotjar.com *.hotjar.io wss://*.hotjar.com; report-uri /report-csp-violation

Diagnostics

Metrics

http

NFS-or-IIS

LSA-or-nterm

personnaliser_les_cookies

Drupal is a free and open-source web content management framework.

Drupal

PHP is a general-purpose scripting language used for web development.

Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.

Bootstrap

Apache is a free and open-source cross-platform web server software.

Apache HTTP Server

Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

Cloudflare

Typekit is an online service which offers a subscription library of fonts.

Typekit

Tiny Slider is a vanilla javascript slider for all purposes.

Tiny Slider

Slick

Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.

Google Tag Manager

cdnjs is a free distributed JS library delivery service.

cdnjs

Clipboard.js

jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.

jQuery UI

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

Hotjar is a suite of analytic tools to assist in the gathering of qualitative data, providing feedback through tools such as heatmaps, session recordings, and surveys.

Hotjar

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

reCAPTCHA

Sectigo provides SSL certificate and computer security products.

Sectigo

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.

name	domain	httpOnly	secure
personnaliser_les_cookies	industriels.esante.gouv.fr	❌	✔️

type	url	details
unknown	use.typekit.net/jjx2ksb.c...
unknown	p.typekit.net/p.css?s=1&k...
cloudflare	cdnjs.cloudflare.com/ajax...	Host files locally
bootstrapcdn	stackpath.bootstrapcdn.co...	Host files locally
cloudflare	cdnjs.cloudflare.com/ajax...	Host files locally
hotjar	static.hotjar.com/c/hotja...	Dont use HotJar
unknown	use.typekit.net/af/9b05f3...
unknown	use.typekit.net/af/2cd6bf...
unknown	use.typekit.net/af/053fc9...
unknown	use.typekit.net/af/c4c302...
unknown	use.typekit.net/af/9b05f3...
unknown	use.typekit.net/af/2cd6bf...
unknown	use.typekit.net/af/053fc9...
unknown	use.typekit.net/af/c4c302...
google tag manager	www.googletagmanager.com/...	Use hosted Matomo instance

flag	country	hostname	ip	city
	France	industriels.esante.gouv.fr	37.59.26.43	Paris
	États Unis	use.typekit.net	104.79.0.25	San José
	États Unis	p.typekit.net	104.79.0.40	San José
	?	cdnjs.cloudflare.com	104.17.25.14	?
	?	stackpath.bootstrapcdn.com	104.18.11.207	?
	États Unis	static.hotjar.com	18.154.132.120	?
	États Unis	www.googletagmanager.com	142.250.176.8	?

https://industriels.esante.gouv.fr/

LightHouse

https://industriels.esante.gouv.fr/11 mois

Cookies11 mois

Scripts tiers11 mois

Déclaration de mise en accessibilité

Conformité partielle