All-in-one free web application security tool. Web application vulnerability and privacy scanner with support for HTTP cookies, Flash, HTML5 localStorage, sessionStorage, CANVAS, Supercookies, Evercookies. Includes a free SSL/TLS, HTML and HTTP vulnerability scanner and URL malware scanner.
Title: "Orion Financial Services LLC – Insurance solutions for Auto, Home, Life, Health, and Business."
Category: Business
Keywords: llc auto care cost life copay https orion quote health policy medical business coverage services financial insurance liability deductible appointment
Privacy Impact Score is a score reflecting overall cookie-related impact of the website relative to other websites, primarily taking into account the number of third-party domains it reports to and number of persistent cookies it sets. See Privacy Impact Score article for more details.
Third-party domains is the count of organisations allowed by the webmaster to trace your across the site. These cookies may be set for various purposes, like tracking ads displayed on the website, collection of statistics, targeted advertising etc. This website allows 1 other websites to track your activity.
Persistent cookies are the cookies that are preserved through browser shutdowns. This means, even if you close this page today and ever return there in future, the website will know you're a returning visitor. This may be used for "remember me" features, as well as persistent user tracking. These cookies, especially if set by third party organisations, are powerful tool for monitoring your activities across all the websites you visit. This website sets 2 persistent cookies with average life-time of 90 days and longest 90 days.
Session cookies are cleared when you close your browser and allow the website to identify user's state — such as logged-in users. They are mostly considered harmless because they cannot be used for long-term user tracking. This site sets 0 session cookies.
Last fetched: 2020-03-29T19:26:26.887744+00:00
HTTP status: 200 200 OK
Advanced user tracking and fingerprinting techniques are used by websites to bypass privacy protection in web browsers and increase tracking persistence.
b'GIF8' … b'\x01\x00\x01\x00'
b'GIF8' … b'\x01\x00\x01\x00'
Server: Apache
Announces web server software and optionally version details.
Read more...Link: <https://www.orionfinancialservices.com/prod/wp-json/>; rel="https://api.w.org/"
Indicates location of sub-resources for the given page, in machine-readable format. It may come in a number of types, for example next page, previous page, index page, preloading resources etc.
Read more...Link: <https://www.orionfinancialservices.com/prod/>; rel=shortlink
Indicates location of sub-resources for the given page, in machine-readable format. It may come in a number of types, for example next page, previous page, index page, preloading resources etc.
Read more...Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
HTTP Strict Transport Security (HSTS) is an opt-in security enhancement that is specified by a web application through the use of a special response header.
Read more...
HTTP Strict Transport Security is enabled
+2X-Robots-Tag: noarchive, nosnippet
Controls the behavior of search engine bots and may contain most of the directives usually found in robots.txt file.
Read more...X-XSS-Protection: 1; mode=block
Controls an Cross-Site Scripting (XSS) filters built into the majority of web browsers. The filter is usually turned on by default anyway, but requirement to set the header to 1
became part of canonical set of "secure" HTTP headers. Over time, vulnerabilities in the "sanitizing" mode filter were found, so 1; mode=block
became the recommended value. Some companies decided that they don't really need a browser-side XSS filter to mess with their web services which are XSS-free anyway and they became consciously disabling the XSS filter by setting the header to 0
.
XSS auditor is enabled in blocking mode
+1X-Content-Type-Options: nosniff
A non-standard but widely accepted header introduced originally by Microsoft to disable "content sniffing" or heuristic content type discovery in absence or mismatch of a proper HTTP Content-Type
declaration, which led to a number of web attacks. In general, presence of the header with its only defined value of nosniff
is considered as part of a properly secured HTTP response.
Fuzzy content type guessing is disabled
+1X-Permitted-Cross-Domain-Policies: all
Header used by Adobe Flash engine to control cross-site access for Flash applications. Most websites not using Flash would prefer to set it with the value of none
as an additional precaution against using them in advanced Flash-based XSS vectors. Flash-serving websites can use them to declare the scope of detailed Flash cross-site policies per Adobe specification.
X-Frame-Options: SAMEORIGIN
Instructs the browser if the current website can be embedded in HTML frame by another website. Since this allows the parent website to control the framed page, this creates a potential for data theft attacks ("clickjacking") and most sensitive websites won't allow them to be framed at all (deny
) or just allow parts of them to be embedded in frames created by themselves only (samesite
).
Clickjacking protection is enabled
+2Referrer-Policy: strict-origin-when-cross-origin
The Referrer-Policy HTTP header governs which referrer information, sent in the Referer header, should be included with requests made.
Read more...
Referrer-Policy enabled
+1Expect-CT: enforce,max-age=2592000,report-uri="https://orionfs.report-uri.com/r/d/ct/enforce"
The Expect-CT header allows sites to opt in to reporting and/or enforcement of Certificate Transparency requirements, which prevents the use of misissued certificates for that site from going unnoticed. When a site enables the Expect-CT header, they are requesting that the browser check that any certificate for that site appears in public CT logs.
Read more...
Expect-CT is in enforcement mode
+2Access-Control-Allow-Origin: https://www.orionfinancialservices.com
Controls origins (websites) that are allowed to load data from this web service over JavaScript-based APIs as part of Cross-Origin Resource Sharing (CORS) standard. By default, a web browser will refuse to load data over XmlHttpRequest
from a website that is not in the same origin, which is a precaution against various types of data stealing attacks. The target server has to explicitly allow the origin domain using the Access-Control-Allow-Origin
(ACAO) header, or it may allow all origins to access it using a wildcard *
. The latter however creates a potential security issue if the website in question is transactional and processing sensitive data, so the wildcard should be only used on websites consciously offering public APIs.
Feature-Policy: usb 'none'; vr 'none'; encrypted-media 'none'; microphone 'none'; payment 'none'; camera 'none'; camera 'none'; midi 'none'; accelerometer 'none'; gyroscope 'none'; speaker 'none'; picture-in-picture 'none'
Allows web developers selectively enable and disable specific web technologies, especially those that enable two-way communication between the user and web application. For example, the header may inform the user mobile device that the website is not using camera or location tracking by design.
Read more...
Feature-Policy enabled
+1Public-Key-Pins: pin-sha256="klO23nT2ehFDXCfx3eHTDRESMz3asj1muO+4aIdjiuY="; pin-sha256="hOF1upiO+xevnDEQ13g3aY3M3Uqa44RN5rVlwvU2WC8="; pin-sha256="grX4Ta9HpZx6tSHkmCrvpApTQGo67CYDnvprLg5yRME="; pin-sha256="lCppFqbkrlJ3EcVFAkeip0+44VaoJUymbnOaEUk7tEU="; max-age=2592000; includeSubDomains, pin-sha256="klO23nT2ehFDXCfx3eHTDRESMz3asj1muO+4aIdjiuY="; pin-sha256="47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU="; pin-sha256="grX4Ta9HpZx6tSHkmCrvpApTQGo67CYDnvprLg5yRME="; pin-sha256="VjLZe/p3W/PJnd6lL8JVNBCGQBZynFLdZSTIqcO0SJ8="; pin-sha256="CT23Z4iPaxMnVV29Qrtck/7exQRMeoS8bqMqV4wiNcA="; pin-sha256="lCppFqbkrlJ3EcVFAkeip0+44VaoJUymbnOaEUk7tEU="; pin-sha256="deISS7OSTh+FchSUItYV0q+ire5fMgk9AUplVGPgCYU="; pin-sha256="9t7SdZ2JcDYcNF9YRfWlXd718cy7PE71BAQziBm28ow="; pin-sha256="633lt352PKRXbOwf4xSEa1M517scpD3l5f79xMD9r9Q="; max-age=2592000; includeSubDomains
Announces a list of X.509 certificate hashes that are allowed to appear in the website's TLS certification path (HTTP Public Key Pinning or HPKP). This prevents malicious proxy servers from transparently replacing the public certificates with their own and wiretapping the TLS connection of the unsuspecting user. This header sets HPKP in enforcement mode.
Read more...
HTTP Public Key Pinning is in enforcement mode. Note that Chrome is deprecating HPKP starting from version 69 but other browsers declared no plans to deprecate
+2P3P: CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM", policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Largely abandoned format for declaring website's privacy policy in machine-readable format. The only reason for many websites to use the header was that old versions of Microsoft Internet Explorer disallowed third-party cookies on websites missing P3P.
Read more...
P3P is a mostly abandoned standard for website privacy policy declaration that has little use today. Please consider switching to DoNotTrack standard.
0Transport Layer Security (TLS) is enabled
+2default-src 'none'; connect-src 'self' https://s3-us-west-2.amazonaws.com/mfesecure-public/host/orionfinancialservices.com/client.json https://www.orionfinancialservices.com https://s.trustpilot.com/ https://www.orionfinancialservices.com/prod https://api.hubapi.com https://forms.hubspot.com ; base-uri 'self' https://www.orionfinancialservices.com https://www.orionfinancialservices.com/prod;font-src 'self' data: https://*.googleapis.com https://*.orionfinancialservices.com https://fonts.gstatic.com https://www.orionfinancialservices.com/prod;form-action 'self' https://*.facebook.com https://connect.facebook.net https://www.orionfinancialservices.com/prod;frame-ancestors 'self' https://www.orionfinancialservices.com/prod https://connect.facebook.net https://*.hubspot.com; frame-src https://*.nowcerts.com https://app.hubspot.com https://connect.facebook.net https://*.boltinsurance.com https://*.orionfinancialservices.com https://*.superioraccess.com https://*.twitter.com https://*.youtube.com https://template.typeform.com https://www.facebook.com https://www.google.com https://www.youtube-nocookie.com; img-src 'self' data: https://*.w.org https://*.hubspot.net https://*.alignable.com https://*.hubspot.com/ https://*.cloudfront.net https://*.googleapis.com https://*.gravatar.com https://*.orionfinancialservices.com https://cdn.ywxi.net/static/ https://stats.g.doubleclick.net https://www.facebook.com https://www.google-analytics.com https://www.orionfinancialservices.com/prod;object-src 'none'; script-src 'report-sample' 'self' 'unsafe-eval' 'unsafe-inline' https://*.nowcerts.com https://s.trustpilot.com/tpelements/2304294/f.jsonp https://*.gstatic.com https://*.orionfinancialservices.com https://*.twitter.com https://*.yahoo.com https://*.youtube.com https://ajax.googleapis.com https://cdn.ywxi.net/js/1.js https://cdn.ywxi.net/static https://connect.facebook.net/ https://connect.facebook.net/en_US/fbevents.js https://connect.facebook.net/signals/plugins/identity.js https://s.ytimg.com https://s3-us-west-2.amazonaws.com/mfesecure-public/host/orionfinancialservices.com/client.js https://www.google-analytics.com https://www.google-analytics.com/analytics.js https://www.google-analytics.com/plugins/ua/linkid.js https://www.google.com/recaptcha/api.js https://*.hotjar.com https://www.orionfinancialservices.com/prod/wp-includes/js/wp-emoji-release.min.js https://www.mcafeesecure.com https://www.orionfinancialservices.com/prod; style-src 'unsafe-inline' https://*.orionfinancialservices.com https://*.youtube.com https://ajax.googleapis.com https://fonts.googleapis.com; upgrade-insecure-requests; report-uri https://orionfs.report-uri.com/r/d/csp/reportOnly
Content-Security-Policy
You should definitely try using 'strict-dynamic'
to eliminate those long lists of trusted third-party scripts
Origin script-src 'unsafe-eval'
allows bypassing of CSP and execution of inlined untrusted scripts. Use 'nonce-'
or 'sha256-'
instead
Origin script-src 'unsafe-inline'
allows bypassing of CSP and execution of inlined untrusted scripts. Use 'nonce-'
or 'sha256-'
instead
Origin script-src https://*.gstatic.com
is known to host JSONP which can be used to bypass CSP and execute untrusted scripts
Origin script-src https://ajax.googleapis.com
is known to host JSONP which can be used to bypass CSP and execute untrusted scripts
Origin script-src https://www.google-analytics.com
is known to host JSONP which can be used to bypass CSP and execute untrusted scripts
Origin script-src https://www.google-analytics.com/analytics.js
is known to host JSONP which can be used to bypass CSP and execute untrusted scripts
Origin script-src https://www.google-analytics.com/plugins/ua/linkid.js
is known to host JSONP which can be used to bypass CSP and execute untrusted scripts
Origin script-src https://www.google.com/recaptcha/api.js
is known to host JSONP which can be used to bypass CSP and execute untrusted scripts
Origin style-src 'unsafe-inline'
allows bypassing of CSP and execution of inlined untrusted scripts. Use 'nonce-'
or 'sha256-'
instead
Want second opinion? Try Google CSP Evaluator.
Most web pages load a number of sub-resources such as images, style sheets (CSS), JavaScript files, web fonts, audio or video files and other web pages in frames. Each of these sub-resources may be loaded from the same server (first-party resource) or servers belonging to other parties (third-party resources). In the latter case, the third-party will see a request coming from your browser with the information on the originating page and it can set its own cookies, both of which are frequently used for user tracking. Note that the cookies set by these sub-resources are already recorded in our cookie statistics for this page.
The page loads 28 third-party JavaScript files and 28 CSS but does not employ Sub-Resource Integrity to prevent breach if a third-party CDN is compromised