{
  "scan": {
    "algorithmVersion": 4,
    "grade": "B",
    "error": null,
    "score": 70,
    "statusCode": 200,
    "testsFailed": 3,
    "testsPassed": 7,
    "testsQuantity": 10,
    "responseHeaders": {
      "date": "Sun, 24 May 2026 06:56:37 GMT",
      "content-type": "text/html; charset=utf-8",
      "content-length": "87436",
      "connection": "close",
      "content-security-policy": "default-src 'self'; object-src 'self'; base-uri 'self'; form-action 'self'; manifest-src https://forest.eea.europa.eu/site.webmanifest; media-src https://*.eea.europa.eu; data:; connect-src 'self' https://*.eea.europa.eu http://*.eea.europa.eu https://europa.eu/webtools/ https://webanalytics.europa.eu https://geocode.arcgis.com  https://api.openaire.eu https://api.openaire.com https://api.zotero.org/ https://cdn.arcgis.com/ https://www.arcgis.com/ https://utility.arcgisonline.com/ https://js.arcgis.com/ https://services.arcgisonline.com  https://services.arcgis.com https://static.arcgis.com https://basemaps.arcgis.com/ https://*.arcgis.com/ https://*.eionet.europa.eu http://*.eea.europa.eu; font-src 'self' data: https://cdnjs.cloudflare.com/ https://fonts.gstatic.com/ https://*.eea.europa.eu https://cdn.arcgis.com/ https://js.arcgis.com/ https://*.eionet.europa.eu https://eea.maps.arcgis.com/; frame-src 'self'  https://europa.eu/  https://*.europa.eu/ https://*.eea.europa.eu http://*.eea.europa.eu https://eea.maps.arcgis.com/; img-src http: https: blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://matomo.eea.europa.eu https://europa.eu/webtools/ https://www.google.com/jsapi https://www.google.com/uds/ https://www.gstatic.com/ https://ajax.googleapis.com/  https://spreadsheets.google.com/ https://docs.google.com/ https://*.eionet.europa.eu https://*.eea.europa.eu http://*.eea.europa.eu https://d3js.org https://cdnjs.cloudflare.com https://code.jquery.com https://services.arcgis.com https://public.tableau.com/javascripts/api/tableau-2.8.0.min.js https://public.tableau.com/javascripts/api/tableau-2.7.0.min.js https://public.tableau.com/javascripts/api/tableau-2.6.0.min.js https://public.tableau.com/javascripts/api/tableau-2.5.0.min.js https://public.tableau.com/javascripts/api/tableau-2.4.0.min.js https://public.tableau.com/javascripts/api/tableau-2.3.0.min.js https://public.tableau.com/javascripts/api/tableau-2.2.2.min.js https://public.tableau.com/javascripts/api/tableau-2.1.2.min.js https://public.tableau.com/javascripts/api/tableau-2.0.3.min.js https://js.arcgis.com/ https://api.openaire.eu https://api.openaire.com https://api.zotero.org/ https://geocode.arcgis.com; frame-ancestors 'self' *.eionet.europa.eu *.eea.europa.eu; style-src 'self' 'unsafe-inline' https://www.google.com/uds/ https://europa.eu/webtools/ https://fonts.googleapis.com/css2 https://js.arcgis.com/ https://api.openaire.eu https://api.openaire.com https://api.zotero.org/ https://ajax.googleapis.com/ https://www.gstatic.com/ https://*.eionet.europa.eu https://*.eea.europa.eu https://cdnjs.cloudflare.com https://code.jquery.com; report-uri https://sentry.eea.europa.eu/api/49/security/?sentry_key=488e90d8a01f47bd8a1851cd020652ce",
      "x-backend-name": "cluster(10.43.153.61:3000)",
      "x-url": "/",
      "x-cacheable": "YES",
      "x-varnish": "164466816 245761191",
      "age": "27",
      "via": "1.1 frontend-dpl-varnish-69f57589c8-txqsb (Varnish/7.7)",
      "accept-ranges": "bytes",
      "grace": "",
      "x-backend": "cluster(frontend-volto:(null))",
      "x-cache": "HIT",
      "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
      "server": "HTTPS",
      "expect-ct": "max-age=604800, report-uri='https://sentry.eea.europa.eu/api/49/security/?sentry_key=488e90d8a01f47bd8a1851cd020652ce'",
      "x-content-type-options": "\"nosniff\"",
      "x-xss-protection": "\"1; mode=block\"",
      "x-frame-options": "'SAMEORIGIN'",
      "referrer-policy": "origin",
      "permissions-policy": "accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(self), usb=()"
    }
  },
  "tests": {
    "content-security-policy": {
      "expectation": "csp-implemented-with-no-unsafe",
      "pass": false,
      "result": "csp-implemented-with-unsafe-inline",
      "scoreModifier": -20,
      "data": {
        "default-src": [
          "'self'"
        ],
        "object-src": [
          "'self'"
        ],
        "base-uri": [
          "'self'"
        ],
        "form-action": [
          "'self'"
        ],
        "manifest-src": [
          "https://forest.eea.europa.eu/site.webmanifest"
        ],
        "media-src": [
          "https://*.eea.europa.eu"
        ],
        "data:": [
          "'none'"
        ],
        "connect-src": [
          "'self'",
          "http://*.eea.europa.eu",
          "https://*.arcgis.com/",
          "https://*.eea.europa.eu",
          "https://*.eionet.europa.eu",
          "https://api.openaire.com",
          "https://api.openaire.eu",
          "https://api.zotero.org/",
          "https://basemaps.arcgis.com/",
          "https://cdn.arcgis.com/",
          "https://europa.eu/webtools/",
          "https://geocode.arcgis.com",
          "https://js.arcgis.com/",
          "https://services.arcgis.com",
          "https://services.arcgisonline.com",
          "https://static.arcgis.com",
          "https://utility.arcgisonline.com/",
          "https://webanalytics.europa.eu",
          "https://www.arcgis.com/"
        ],
        "font-src": [
          "'self'",
          "data:",
          "https://*.eea.europa.eu",
          "https://*.eionet.europa.eu",
          "https://cdn.arcgis.com/",
          "https://cdnjs.cloudflare.com/",
          "https://eea.maps.arcgis.com/",
          "https://fonts.gstatic.com/",
          "https://js.arcgis.com/"
        ],
        "frame-src": [
          "'self'",
          "http://*.eea.europa.eu",
          "https://*.eea.europa.eu",
          "https://*.europa.eu/",
          "https://eea.maps.arcgis.com/",
          "https://europa.eu/"
        ],
        "img-src": [
          "blob:",
          "data:",
          "http:",
          "https:"
        ],
        "script-src": [
          "'self'",
          "'unsafe-eval'",
          "'unsafe-inline'",
          "blob:",
          "data:",
          "http://*.eea.europa.eu",
          "https://*.eea.europa.eu",
          "https://*.eionet.europa.eu",
          "https://ajax.googleapis.com/",
          "https://api.openaire.com",
          "https://api.openaire.eu",
          "https://api.zotero.org/",
          "https://cdnjs.cloudflare.com",
          "https://code.jquery.com",
          "https://d3js.org",
          "https://docs.google.com/",
          "https://europa.eu/webtools/",
          "https://geocode.arcgis.com",
          "https://js.arcgis.com/",
          "https://matomo.eea.europa.eu",
          "https://public.tableau.com/javascripts/api/tableau-2.0.3.min.js",
          "https://public.tableau.com/javascripts/api/tableau-2.1.2.min.js",
          "https://public.tableau.com/javascripts/api/tableau-2.2.2.min.js",
          "https://public.tableau.com/javascripts/api/tableau-2.3.0.min.js",
          "https://public.tableau.com/javascripts/api/tableau-2.4.0.min.js",
          "https://public.tableau.com/javascripts/api/tableau-2.5.0.min.js",
          "https://public.tableau.com/javascripts/api/tableau-2.6.0.min.js",
          "https://public.tableau.com/javascripts/api/tableau-2.7.0.min.js",
          "https://public.tableau.com/javascripts/api/tableau-2.8.0.min.js",
          "https://services.arcgis.com",
          "https://spreadsheets.google.com/",
          "https://www.google.com/jsapi",
          "https://www.google.com/uds/",
          "https://www.gstatic.com/"
        ],
        "frame-ancestors": [
          "'self'",
          "*.eea.europa.eu",
          "*.eionet.europa.eu"
        ],
        "style-src": [
          "'self'",
          "'unsafe-inline'",
          "https://*.eea.europa.eu",
          "https://*.eionet.europa.eu",
          "https://ajax.googleapis.com/",
          "https://api.openaire.com",
          "https://api.openaire.eu",
          "https://api.zotero.org/",
          "https://cdnjs.cloudflare.com",
          "https://code.jquery.com",
          "https://europa.eu/webtools/",
          "https://fonts.googleapis.com/css2",
          "https://js.arcgis.com/",
          "https://www.google.com/uds/",
          "https://www.gstatic.com/"
        ],
        "report-uri": [
          "https://sentry.eea.europa.eu/api/49/security/?sentry_key=488e90d8a01f47bd8a1851cd020652ce"
        ]
      },
      "http": true,
      "meta": false,
      "policy": {
        "antiClickjacking": true,
        "defaultNone": false,
        "insecureBaseUri": false,
        "insecureFormAction": false,
        "insecureSchemeActive": true,
        "insecureSchemePassive": true,
        "strictDynamic": false,
        "unsafeEval": true,
        "unsafeInline": true,
        "unsafeInlineStyle": true,
        "unsafeObjects": false
      },
      "numPolicies": 1
    },
    "cookies": {
      "expectation": "cookies-secure-with-httponly-sessions",
      "pass": true,
      "result": "cookies-not-found",
      "scoreModifier": 0,
      "data": null,
      "sameSite": false
    },
    "cross-origin-resource-sharing": {
      "expectation": "cross-origin-resource-sharing-not-implemented",
      "pass": true,
      "result": "cross-origin-resource-sharing-not-implemented",
      "scoreModifier": 0,
      "data": null
    },
    "redirection": {
      "expectation": "redirection-to-https",
      "pass": true,
      "result": "redirection-to-https",
      "scoreModifier": 0,
      "destination": "https://forest.eea.europa.eu/",
      "redirects": true,
      "route": [
        "http://forest.eea.europa.eu/",
        "https://forest.eea.europa.eu/"
      ],
      "statusCode": 200
    },
    "referrer-policy": {
      "expectation": "referrer-policy-private",
      "pass": false,
      "result": "referrer-policy-unsafe",
      "scoreModifier": -5,
      "data": "origin",
      "http": true,
      "meta": false
    },
    "strict-transport-security": {
      "expectation": "hsts-implemented-max-age-at-least-six-months",
      "pass": true,
      "result": "hsts-implemented-max-age-at-least-six-months",
      "scoreModifier": 0,
      "data": "max-age=31536000; includeSubDomains; preload",
      "includeSubDomains": true,
      "maxAge": 31536000,
      "preload": true,
      "preloaded": false
    },
    "subresource-integrity": {
      "expectation": "sri-implemented-and-external-scripts-loaded-securely",
      "pass": true,
      "result": "sri-not-implemented-but-all-scripts-loaded-from-secure-origin",
      "scoreModifier": 0,
      "data": {}
    },
    "x-content-type-options": {
      "expectation": "x-content-type-options-nosniff",
      "pass": false,
      "result": "x-content-type-options-header-invalid",
      "scoreModifier": -5,
      "data": "\"nosniff\""
    },
    "x-frame-options": {
      "expectation": "x-frame-options-sameorigin-or-deny",
      "pass": true,
      "result": "x-frame-options-implemented-via-csp",
      "scoreModifier": 5,
      "data": "'SAMEORIGIN'"
    },
    "cross-origin-resource-policy": {
      "expectation": "corp-implemented-with-same-site",
      "pass": true,
      "result": "corp-not-implemented",
      "scoreModifier": 0,
      "data": null,
      "http": false,
      "meta": false
    }
  }
}