WebForensik

Results for https://bk-sicherheitsdienst.de/

Scan time: 2026-10-03 19:28:39

Overall Score

Score history for this domain View full history →

91 17.10. 91 18.10. 91 18.10. 91 18.10. 91 20.10. 91 20.10. 91 20.10. 91 21.10. 91 22.10. 91 22.10.

GDPR Summary

✔ This website meets basic data protection requirements.

Note: This automated analysis does not replace legal advice. For a complete GDPR assessment, consult a data protection officer.

↓ See detailed results for each category below.

95 HTTPS / Encryption

The website uses an encrypted connection (HTTPS).

Latest encryption active (TLS 1.3 — TLSv1.3).

The security certificate is valid (expires 2026-12-23).

Adequate encryption method (TLS_AES_128_GCM_SHA256, 128 bit).

☛ Action needed: The encryption method is adequate but not optimal. Ask your hosting provider to configure stronger cipher suites.

80 Enforced Encryption (HSTS)

HSTS is enabled — the browser is instructed to always use the encrypted connection.

HSTS duration: 31536000 seconds (at least 1 year) — very good.

75 Content Security Policy (CSP)

Content Security Policy present (via HTTP-Header).

Script sources are properly restricted.

Embedding protection (frame-ancestors) is configured — protects against clickjacking.

Good base rule: only own content is allowed by default (default-src: self).

100 Referrer Policy

Referrer-Policy: strict-origin-when-cross-origin (via HTTP-Header).

Strict setting "strict-origin-when-cross-origin" — no path leak, no HTTP downgrade leak. Best practice.

100 MIME Type Protection

MIME type protection active (nosniff) — browsers will not misinterpret files.

100 Clickjacking Protection

Clickjacking protection active via CSP frame-ancestors.

75 Permissions (Camera, Microphone, etc.)

Permissions-Policy is configured — access to sensitive device APIs is controlled.

3 of 6 sensitive APIs restricted. More restrictions recommended.

☛ Action needed: Restrict more sensitive APIs. Recommended: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()

▸ How to fix this — step-by-step guide

You have a Permissions-Policy but only few APIs are restricted (3 of 6). Restrict all sensitive APIs you don’t actively need.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()"
</IfModule>

⚠ Replace the existing entry. If you actually need an API: "(self)" instead of "()".

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()"
</IfModule>

⚠ Replace the existing Permissions-Policy.

✓ How to verify it works: F12 → Network → Response Header: full Permissions-Policy line visible.

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

100 Cookies

No cookies set — exemplary for privacy.

100 Local Storage (Web Storage)

No local storage (Web Storage) used — no tracking risk.

100 Third-Party Requests

No third-party requests detected — all content comes from the website's own server.

100 Tracker Detection

No known trackers detected.

100 External Resource Integrity (SRI)

No external scripts or stylesheets loaded.

65 DNS Security

No CAA records. Any certificate authority could issue a certificate for this domain.

☛ Action needed: Create CAA DNS records to specify which certificate authorities may issue certificates for your domain. This prevents unauthorized certificates from being issued.

▸ How to fix this — step-by-step guide

CAA records (Certification Authority Authorization) define in DNS which Certificate Authorities are allowed to issue certificates for your domain. Without a CAA record an attacker could request a fraudulent certificate for your domain at any CA. CAA is pure DNS configuration — set in your registrar/DNS-panel, NOT in WordPress.

☞ Concrete CAA values for the ten most common DACH-region hosts

Find your host in the table, copy the values to your DNS panel. For multi-CA hosts: one separate CAA record per CA (all with tag issue, flag 0, name @). Additionally recommended: an iodef record with a contact email for abuse reports.

#	Host	CA(s) used	CAA value(s) — tag `issue`
1	Hetzner Webhosting (basic certificate, free in package)	DigiCert (programme „Encryption Everywhere")	`digicert.com`
1	Hetzner Webhosting (Let’s Encrypt, free)	Let’s Encrypt (ISRG)	`letsencrypt.org`
2	All-Inkl	Let’s Encrypt + Sectigo (Pro)	`letsencrypt.org` `sectigo.com`
3	IONOS (1&1)	DigiCert (GeoTrust) + Let’s Encrypt	`digicert.com` `letsencrypt.org`
4	STRATO	Sectigo + Let’s Encrypt	`sectigo.com` `letsencrypt.org`
5	Cloudflare (Universal SSL)	Google Trust Services + DigiCert + Let’s Encrypt	`pki.goog` `digicert.com` `letsencrypt.org`
6	AWS (ACM / CloudFront)	Amazon Trust Services	`amazon.com` `amazontrust.com` `awstrust.com` `amazonaws.com`
7	Mittwald	Let’s Encrypt + Sectigo	`letsencrypt.org` `sectigo.com`
8	Webgo	Let’s Encrypt + Sectigo	`letsencrypt.org` `sectigo.com`
9	raidboxes (Managed WordPress)	Let’s Encrypt	`letsencrypt.org`
10	Host Europe / DomainFactory	Sectigo + Let’s Encrypt	`sectigo.com` `letsencrypt.org`

Name   Type   Flag   Tag      Value
@      CAA    0      issue    "digicert.com"
@      CAA    0      issue    "letsencrypt.org"
@      CAA    0      iodef    "mailto:security@your-domain.com"

The iodef line (last line) is optional but recommended: CAs report abuse attempts to that address. For subdomains (e.g. shop.your-domain.com) create separate records with the subdomain name instead of @ — modern CAs check parent CAA automatically though.

If your host is not on the list: open your current certificate in the browser (padlock → certificate → issuer). The CA name is shown there (e.g. "Sectigo RSA Domain Validation Secure Server CA" → value sectigo.com). Add that as a CAA record, done.

WordPress Special for WordPress: where to add this

WordPress plugin: CAA records are NOT created in WordPress but in your domain registrar / DNS provider panel (e.g. Hetzner-Robot, IONOS Domains, Cloudflare Dashboard, INWX, etc.). Common label: "CAA record" or under "TXT records" with type selector "CAA". One separate record per CA.

✓ How to verify it works: On https://www.ssllabs.com/ssltest/analyze.html?d=your-domain.com → "DNS CAA" section → all your CAs should be listed. Or via dig: dig CAA your-domain.com.

3 nameservers present — good redundancy.

No IPv6 support (no AAAA record).

☛ Action needed: Enable IPv6 support (AAAA records) for your domain. More and more users are using IPv6.

▸ How to fix this — step-by-step guide

Your domain has no IPv6 address (AAAA record). Over 40% of users (especially mobile) reach the internet via IPv6 — they must take the slower IPv4 gateway detour.

WordPress Special for WordPress: where to add this

WordPress plugin: Pure DNS + server matter. Step 1: check if your host has an IPv6 address for you (hosting panel or support ticket). Step 2: in the DNS panel create an AAAA record pointing to that IPv6. Step 3: test.

✓ How to verify it works: dig AAAA your-domain.com — or online https://ipv6-test.com/validate.php?url=your-domain.com.

SPF record present: v=spf1 include:spf.dynamic.domaincrush.de -all — protects against email spoofing.

DMARC record present: v=DMARC1; p=none; pct=100; rua=mailto:contact@alexheld.io; ruf=mailto:contact@alexheld.io; sp=none — email authentication active.

100 Security Contact (security.txt)

security.txt found: https://bk-sicherheitsdienst.de/.well-known/security.txt

Contact field present (required) — security researchers can report vulnerabilities.

Expires field present (required).

100 External Reporting Endpoints

No external reporting endpoints detected.

80 Cookie Consent

No consent banner needed — no trackers or third-party cookies detected.

100 Privacy Policy & Legal Notice

Legal notice linked: "Impressum" (/impressum).

⚙ Your ready-to-use security .htaccess

All missing security headers combined into one block. Append this block to the end of your .htaccess — done. 1 headers will be set.

Apache Standard Apache (any host, without WordPress)

Append this block to the end of your .htaccess in the web root — done.

<IfModule mod_headers.c>
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()"
</IfModule>

WordPress WordPress: .htaccess in WP root

Insert this block ABOVE the "# BEGIN WordPress" line, otherwise WP overwrites it on permalink changes.

# BEGIN WebForensik Security
<IfModule mod_headers.c>
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()"
</IfModule>
# END WebForensik Security

WordPress Alternative for WordPress: functions.php in child theme

If your host disallows .htaccess changes: append this PHP snippet to the end of your CHILD theme's functions.php. Back up first — NEVER edit the parent theme, it gets overwritten on updates.

add_action('send_headers', function () {
    header("Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()");
});

Dry-run — we re-load your site with the proposed headers and show which resources would be blocked. Takes about 30 seconds.

HTTP Response Headers

Header	Value
accept-ranges	bytes
content-length	1363
content-security-policy	default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; frame-src 'self'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; media-src 'self' blob:; connect-src 'self'; upgrade-insecure-requests
content-type	text/html
date	Sat, 03 Oct 2026 17:28:36 GMT
etag	"6abc4b57-553"
last-modified	Tue, 29 Sep 2026 23:35:51 GMT
permissions-policy	camera=(), microphone=(), geolocation=()
referrer-policy	strict-origin-when-cross-origin
server	nginx/1.27.5
strict-transport-security	max-age=31536000
x-content-type-options	nosniff
x-frame-options	SAMEORIGIN

New Scan · Compare

Embed your score on your website

Show your WebForensik score publicly. The badge is a lightweight SVG, loads fast, and respects your visitors' privacy (no tracking).

HTML code to embed (this specific scan)

<a href="https://webforensik.de/results.php?id=2517" target="_blank" rel="noopener">
  <img src="https://webforensik.de/badge.php?id=2517" alt="WebForensik Score" width="174" height="28">
</a>

Or dynamically — always shows the latest scan of this domain

<a href="https://webforensik.de/?url=https://bk-sicherheitsdienst.de" target="_blank" rel="noopener">
  <img src="https://webforensik.de/badge.php?domain=bk-sicherheitsdienst.de" alt="WebForensik Score" width="174" height="28">
</a>