Skip to main content

HTTP-Header für lidl.at

Die sechs wichtigsten Security-Header — gesetzt oder nicht?

Security-Header

HTTP 200
Strict-Transport-Security ✓ gesetzt
max-age=63072000; includeSubDomains; preload

HSTS verhindert SSL-Stripping. Empfohlen: max-age=31536000; includeSubDomains

Content-Security-Policy ✓ gesetzt
default-src 'self' blob: https://*.facebook.com https://*.facebook.net https://*.adsrvr.org https://*.api.schwarz https://*.assets.schwarz https://*.batch.com https://*.bing.com https://bat.bing.net https://*.cliplister.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.exactag.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.experimentation.dev https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.de https://*.lidlplus.com https://*.livebuy.io https://*.medallia.eu https://mycliplister.com https://*.mycliplister.com https://*.peakprotect.com https://*.pingdom.net https://*.virtualearth.net https://*.friendlycaptcha.com https://*.googleapis.com https://asset.schwarz https://autosuggest.search.hereapi.com https://bidswitch.net https://cdn.cookielaw.org https://*.clarity.ms https://creativecdn.com https://form.lidl.com https://*.onetrust.com https://lidl.de https://lidl.media01.eu https://*.google-analytics.com https://region1.analytics.google.com https://s.kelkoogroup.net https://s.kk-resources.com https://sdk.virtualearth.net https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://*.doubleclick.net https://test.formcycle.vdc.lidl https://www.awin1.com https://www.google.be https://www.google.com https://google.com https://www.google.cz https://www.google.nl https://www.google.pl https://www.google.sk https://www.googleadservices.com https://*.gstatic.com https://youtube.com https://*.youtube-nocookie.com https://*.youtube.com https://www.googletagmanager.com https://lidlplusprod.blob.core.windows.net https://lidl.media.schwarz https://upeimagesprd.blob.core.windows.net https://lidlplusstorage.blob.core.windows.net https://*.scon.schwarz wss://endpoint-prod.scon.schwarz https://*.simplesurance.com https://*.frcapi.com https://*.app.baqend.com 'unsafe-inline' https://*.adyen.com https://*.lidl.at data: https://csp.cre.lidl-shop.com; frame-src 'self' https://*.facebook.com https://*.facebook.net https://*.adsrvr.org https://*.cliplister.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.experimentation.dev https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-onlinenewsletter.de https://*.lidl-shop.com https://*.lidl.com https://*.lidl.de https://*.livebuy.io https://*.medallia.eu https://*.pingdom.net https://*.googleapis.com https://balancechecks.tx-gate.com https://bidswitch.net https://creativecdn.com https://form.lidl.com https://forms-prod.enc-test.de/ https://ldl.viewer.cit-fusion.com https://lidl.de https://lidl.media01.eu https://*.google-analytics.com https://region1.analytics.google.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://*.doubleclick.net https://test.formcycle.vdc.lidl https://www.awin1.com https://www.google.com https://www.googleadservices.com https://*.gstatic.com https://youtube.com https://*.youtube-nocookie.com https://*.youtube.com https://www.googletagmanager.com https://www.lidl-gewinnspiel.de https://www.youtube.com https://link.tink.com https://manuals.sit-connect.com https://*.frcapi.com 'unsafe-inline' https://*.adyen.com https://sicherheitsdatenblatt.lidl.at https://*.lidl.at; img-src 'self' blob: https://*.facebook.com https://*.facebook.net https://*.360yield.com https://*.addthis.com https://*.adnxs.com https://*.assets.schwarz https://*.bing.com https://*.cat-ret.assets.lidl https://*.cdn.flavedo.io https://*.cliplister.com https://*.cookiebot.com https://*.criteo.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.experimentation.dev https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-onlinenewsletter.de https://*.lidl-shop.com https://*.lidl.de https://*.lidlplus.com https://*.livebuy.io https://*.medallia.eu https://*.mycliplister.com https://*.retail.lidl.net https://*.retail.vdc.lidl https://*.searchhub.io https://*.smartadserver.com https://*.virtualearth.net https://*.googleapis.com https://asset.schwarz https://bidswitch.net https://cdn.cookielaw.org https://content.odj.cloud https://*.clarity.ms https://cm.adform.net https://form.lidl.com https://lidl.de https://lidl.media01.eu https://*.google-analytics.com https://region1.analytics.google.com https://size.lidl.com https://s.kelkoogroup.net https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://sync.targeting.unrulymedia.com https://*.doubleclick.net https://test.formcycle.vdc.lidl https://www.adobe.com https://www.awin1.com https://cdn.flavedo.io https://www.google.at https://www.google.ba https://www.google.be https://www.google.bg https://www.google.ch https://www.google.co.uk https://www.google.com https://www.google.com.bd https://www.google.com.tr https://www.google.com.ua https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fr https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.is https://www.google.it https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.md https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.se https://www.google.sk https://www.googleadservices.com https://*.gstatic.com https://www.lidl-shop.be https://www.lidl-shop.cz https://www.lidl-shop.nl https://www.lidl-shop.sk https://www.lidl-sklep.pl https://www.w3.org https://x.bidswitch.net https://youtube.com https://*.creativecdn.com https://*.youtube.com https://www.googletagmanager.com https://lidlplusprod.blob.core.windows.net https://lidl.media.schwarz https://upeimagesprd.blob.core.windows.net https://lidlplusstorage.blob.core.windows.net https://c1.adform.net https://ce.lijit.com https://criteo-partners.tremorhub.com https://*.teads.tv https://dpm.demdex.net https://e1.emxdgt.com https://eb2.3lift.com https://exchange.mediavine.com https://hb.yahoo.net https://id5-sync.com https://jadserve.postrelease.com https://matching.ivitrack.com https://mycliplister.com https://pixel.rubiconproject.com https://*.casalemedia.com https://sync-criteo.ads.yieldmo.com https://sync.1rx.io https://rt.udmserve.net https://ssc-cms.33across.com https://ads.yieldmo.com https://s.seedtag.com https://sync.go.sonobi.com https://fast.nexx360.io https://*.upe.schwarz https://media.sit-connect.com https://api.scon-assets.schwarz https://*.app.baqend.com 'unsafe-inline' https://*.adyen.com https://*.lidl.at data:; object-src 'self' https://*.facebook.com https://*.facebook.net https://*.batch.com https://*.cookiebot.com https://*.criteo.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.leaflets.schwarz https://*.lidl-shop.com https://*.lidl.de https://*.livebuy.io https://asset.schwarz https://bidswitch.net https://form.lidl.com https://lidl.de https://lidl.media01.eu https://*.google-analytics.com https://region1.analytics.google.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.google.com https://www.googleadservices.com https://*.gstatic.com https://youtube.com https://*.youtube.com https://www.googletagmanager.com https://manuals.sit-connect.com 'unsafe-eval'; script-src 'self' blob: https://*.facebook.com https://*.facebook.net https://*.adsrvr.org https://*.api.schwarz https://*.batch.com https://*.bing.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.exactag.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.experimentation.dev https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.com https://*.lidl.de https://*.livebuy.io https://*.medallia.eu https://mycliplister.com https://*.mycliplister.com https://*.peakprotect.com https://*.pingdom.net https://*.searchhub.io https://*.virtualearth.net https://*.friendlycaptcha.com https://*.googleapis.com https://adservice.google.com https://asset.schwarz https://bidswitch.net https://cdn.cookielaw.org https://*.clarity.ms https://creativecdn.com https://form.lidl.com https://*.onetrust.com https://lidl.de https://lidl.media01.eu https://*.google-analytics.com https://region1.analytics.google.com https://s.kk-resources.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://*.doubleclick.net https://test.formcycle.vdc.lidl https://www.awin1.com https://www.google.com https://www.googleadservices.com https://*.gstatic.com https://youtube.com https://*.youtube.com https://www.googletagmanager.com https://*.scon.schwarz https://partnersbenefits-uat-we.k8s.scrm.apps.schwarz https://*.app.baqend.com 'unsafe-eval' 'unsafe-inline' about: https://localhost https://*.adyen.com; style-src 'self' https://*.bing.com https://*.cookiebot.com https://*.criteo.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.experimentation.dev https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.de https://*.medallia.eu https://*.googleapis.com https://asset.schwarz https://bidswitch.net https://form.lidl.com https://lidl.de https://lidl.media01.eu https://*.google-analytics.com https://region1.analytics.google.com https://sdk.virtualearth.net https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.google.com https://www.googleadservices.com https://*.gstatic.com https://www.lidl-shop.be https://www.lidl-shop.cz https://www.lidl-shop.nl https://www.lidl-shop.sk https://www.lidl-sklep.pl https://youtube.com https://*.youtube.com https://www.googletagmanager.com https://partnersbenefits-uat-we.k8s.scrm.apps.schwarz https://*.app.baqend.com 'unsafe-inline'; frame-ancestors 'self' https://*.lidl.com https://*.livebuy.io; report-uri https://csp.cre.lidl-shop.com/csp/report; base-uri 'self'; form-action 'self' https://*.facebook.com https://*.facebook.net https://accounts.lidl.com https://survey.g.doubleclick.net https://payments.lidlplus.com;

CSP — wichtigster Schutz gegen XSS.

X-Frame-Options ✓ gesetzt
SAMEORIGIN

Schuetzt vor Clickjacking. DENY oder SAMEORIGIN.

X-Content-Type-Options ✓ gesetzt
nosniff

Sollte "nosniff" sein — verhindert MIME-Sniffing.

Referrer-Policy ✗ fehlt

strict-origin-when-cross-origin oder strenger.

Permissions-Policy ✗ fehlt

Schaltet unerwünschte Browser-Features ab (Geolocation, Mikrofon, etc.).

Befunde (2)

  • Header fehlt: Referrer-Policy
  • Header fehlt: Permissions-Policy

Was sind HTTP-Security-Header?

HTTP-Security-Header sind kleine Anweisungen, die dein Webserver mit jeder Antwort an den Browser mitschickt. Sie sagen dem Browser, wie er die Webseite behandeln soll — beispielsweise: "Lass keine fremden Skripte zu" (CSP), "Lade mich nie als iframe" (X-Frame-Options) oder "Sprich mit mir nur über HTTPS" (HSTS).

Die sechs hier geprüften Header decken die wichtigsten Angriffsklassen ab: HSTS verhindert SSL-Stripping bei Man-in-the-Middle-Angriffen. CSP ist die wichtigste Verteidigung gegen Cross-Site-Scripting (XSS). X-Frame-Options blockt Clickjacking. X-Content-Type-Options verhindert MIME-Sniffing-Angriffe. Referrer-Policy kontrolliert, welche Informationen beim Klick auf externe Links übertragen werden. Permissions-Policy regelt, welche Browser-Features (Geolocation, Mikrofon, Kamera) auf der Seite erlaubt sind.

Header werden in der Webserver-Konfiguration gesetzt — bei nginx in add_header, bei Apache in Header set, bei Cloudflare über "Transform Rules". Bei Frameworks wie Flask oder Express gibt es Helm-Pakete (z. B. flask-talisman), die alles mit sinnvollen Defaults konfigurieren.

Auch für lidl.at prüfen

Hintergrund im Lexikon

Vollständiger Sicherheits-Audit für lidl.at

SSL, Header, DNS, E-Mail, DSGVO, CMS und CVEs in einem Bericht.

Geprüft am 14.05.2026 22:23 Uhr · Aus Cache (24 h-TTL)