default-src 'self' 'unsafe-inline' www.youtube-nocookie.com www.google-analytics.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' code.jquery.com stackpath.bootstrapcdn.com cdn.jsdelivr.net www.googletagmanager.com tagmanager.google.com tag.aticdn.net www.gstatic.com cdnjs.cloudflare.com js/intlTelInput.js www.google.com static.hotjar.com script.hotjar.com static.hotjar.com/c/hotjar-3253247.js script.hotjar.com/modules.bd615e91f206bba6c106.js; object-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' use.typekit.net stackpath.bootstrapcdn.com www.googletagmanager.com cdn.jsdelivr.net maxcdn.bootstrapcdn.com p.typekit.net fonts.googleapis.com tagmanager.google.com ton.twimg.com www.gstatic.com/charts/ css/intlTelInput.css static.hotjar.com script.hotjar.com cdnjs.cloudflare.com static.piste.gouv.fr; img-src 'self' 'unsafe-inline' data: i.ytimg.com www.googletagmanager.com pbs.twimg.com logs1412.xiti.com www.google-analytics.com/g/collect static.hotjar.com script.hotjar.com cdn.jsdelivr.net static.piste.gouv.fr; media-src 'self' 'unsafe-inline'; frame-src 'self' www.youtube-nocookie.com www.youtube.com view.genial.ly www.google.com vars.hotjar.com view.genially.com; child-src 'self' www.youtube-nocookie.com; font-src 'self' 'unsafe-inline' use.typekit.net *.bootstrapcdn.com cdn.jsdelivr.net themes.googleusercontent.com fonts.gstatic.com data: script.hotjar.com cdnjs.cloudflare.com; connect-src 'self' logs1412.xiti.com www.google-analytics.com/g/collect *.hotjar.com *.hotjar.io wss://*.hotjar.com; report-uri /report-csp-violation

Diagnostics

Metrics

http

https

NFS-or-IIS

LSA-or-nterm

personnaliser_les_cookies

Drupal is a free and open-source web content management framework.

Drupal

PHP is a general-purpose scripting language used for web development.

Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.

Bootstrap

Apache is a free and open-source cross-platform web server software.

Apache HTTP Server

Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

Cloudflare

Typekit is an online service which offers a subscription library of fonts.

Typekit

Tiny Slider is a vanilla javascript slider for all purposes.

Tiny Slider

Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.

Google Tag Manager

cdnjs is a free distributed JS library delivery service.

cdnjs

Matomo Analytics is a free and open-source web analytics application, that runs on a PHP/MySQL web-server.

Matomo Analytics

jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.

jQuery UI

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

Hotjar is a suite of analytic tools to assist in the gathering of qualitative data, providing feedback through tools such as heatmaps, session recordings, and surveys.

Hotjar

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

reCAPTCHA

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.

severity	service	vulnerability
info	http (port:80)
info	https (port:443)
info	NFS-or-IIS (port:1025)
info	LSA-or-nterm (port:1026)

Impact	Description	Documentation
-20	Content Security Policy (CSP) implemented unsafely. This includes `'unsafe-inline'` or `data:` inside `script-src`, overly broad sources such as `https:` inside `object-src` or `script-src`, or not restricting the sources for `object-src` or `script-src`.	Remove `unsafe-inline` and `data:` from `script-src`, overly broad sources from `object-src` and `script-src`, and ensure `object-src` and `script-src` are set.
-5	Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS.	Add SRI to external scripts.

risk	name
Medium (High)	CSP: Failure to Define Directive with No Fallback
Medium (High)	CSP: script-src unsafe-eval
Medium (High)	CSP: script-src unsafe-inline
Medium (High)	CSP: style-src unsafe-inline
Medium (High)	Content Security Policy (CSP) Header Not Set
Medium (High)	Sub Resource Integrity Attribute Missing
Medium (Low)	Absence of Anti-CSRF Tokens
Low (High)	CSP: Notices
Low (Medium)	Big Redirect Detected (Potential Sensitive Information Leak)
Low (Medium)	Cross-Domain JavaScript Source File Inclusion
Low (Medium)	Insufficient Site Isolation Against Spectre Vulnerability
Low (Medium)	Permissions Policy Header Not Set
Low (Low)	Full Path Disclosure
Low (Low)	Timestamp Disclosure - Unix
Informational (High)	Sec-Fetch-Dest Header is Missing
Informational (High)	Sec-Fetch-Mode Header is Missing
Informational (High)	Sec-Fetch-Site Header is Missing
Informational (High)	Sec-Fetch-User Header is Missing
Informational (Medium)	Base64 Disclosure
Informational (Medium)	Modern Web Application
Informational (Medium)	Session Management Response Identified
Informational (Medium)	Storable and Cacheable Content
Informational (Low)	Re-examine Cache-control Directives

https://industriels.esante.gouv.fr

Nmap

Mozilla HTTP observatory

SSL

Expiration : 30/08/2025

Scan OWASP7 jours