WebForensik

Results for https://www.xvideos.com/

Scan time: 2026-10-17 05:52:26

Overall Score

Changes since the last scan +9 improved

Compared with scan from 27.09.2026 22:45 (Score 55 → 64) · View full history

Third-Party Requests 20→50 Tracker Detection 60→100 Cookies 45→90

✓ Protections gained: cookies_summary, tracker_none

Score history for this domain View full history →

55 26.09. 55 27.09. 55 27.09. 55 27.09. 55 27.09. 55 27.09. 55 27.09. 64 17.10. 64 22.10. 64 24.10.

GDPR Summary

⚠ This website needs improvement regarding data protection.

GDPR Issues Detected (1):

⚠ Missing or unsafe Referrer-Policy — URLs containing personal data may be leaked to third parties.

Note: This automated analysis does not replace legal advice. For a complete GDPR assessment, consult a data protection officer.

↓ See detailed results for each category below.

100 HTTPS / Encryption

The website uses an encrypted connection (HTTPS).

Latest encryption active (TLS 1.3 — TLSv1.3).

The security certificate is valid (expires 2027-01-28).

Strong encryption method (TLS_AES_256_GCM_SHA384, 256 bit).

0 Enforced Encryption (HSTS)

No HSTS header set. Browsers are not forced to use the encrypted connection.

☛ Action needed: Enable HSTS so browsers always use the encrypted connection. Ask your hosting provider or add this header to your server configuration: Strict-Transport-Security: max-age=31536000; includeSubDomains

▸ How to fix this — step-by-step guide

HSTS (HTTP Strict Transport Security) tells the browser: "Always use HTTPS for this domain — no matter what." This prevents attackers on the same WLAN from intercepting the first, unprotected request. Prerequisite: your site is already stable on HTTPS.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

⚠ max-age=31536000 equals 1 year (in seconds). includeSubDomains also covers blog.your-domain.com, shop.your-domain.com etc. — only enable if ALL subdomains support HTTPS, otherwise they become unreachable.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

# BEGIN WebForensik HSTS
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>
# END WebForensik HSTS

⚠ Insert ABOVE the "# BEGIN WordPress" line. Only enable once HTTPS has been stable for a few days — the header is intentionally hard to roll back (browsers remember the instruction).

Option 2: via functions.php in the child theme (Advanced alternative)

File: functions.php of your CHILD theme (Appearance → Theme File Editor → functions.php)

add_action('send_headers', function () {
    header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
});

⚠ NEVER edit the parent theme — changes are lost on update. Back up functions.php first!

✓ How to verify it works: DevTools (F12) → Network tab → reload page → click the first request → "Response Headers" — must contain "strict-transport-security: max-age=31536000…".

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

35 Content Security Policy (CSP)

Content Security Policy present (via HTTP-Header).

Script sources are too broad (wildcard, http:, etc.) — practically no protection.

☛ Action needed: Your CSP allows scripts from any source — this provides virtually no protection. Restrict allowed script sources to specific domains.

▸ How to fix this — step-by-step guide

Your script-src is so broad (wildcard *, http:, …) that practically any code can be loaded — protection is effectively zero. You need to list allowed domains explicitly.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
</IfModule>

⚠ After "script-src 'self'" list only domains you actually need. Step-by-step approach: remove all wildcards, reload, F12 console shows blocked domain → add → repeat. The other directives (img-src data:, style-src 'unsafe-inline') are kept pragmatic so WordPress emoji, admin bar and plugin inline-styles don't break.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
</IfModule>

⚠ Add domains after "script-src 'self'" as needed (space-separated, prefixed with https://). IMPORTANT: img-src data: and style-src 'unsafe-inline' MUST stay — without them WordPress emoji, admin-bar icons and plugin inline-styles will break.

✓ How to verify it works: F12 → Console. If something is blocked: "Refused to load the script ‘https://…’" — identify the URL, add its domain to script-src, reload.

Good base rule: only own content is allowed by default (default-src: self).

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

20 Referrer Policy

Referrer-Policy: no-referrer-when-downgrade (via HTTP-Header).

The setting "no-referrer-when-downgrade" shares too much URL information with other websites.

☛ Action needed: Change the Referrer-Policy to a more privacy-friendly setting like "strict-origin-when-cross-origin" or "no-referrer". The current setting shares too much information with third parties.

▸ How to fix this — step-by-step guide

Your current Referrer-Policy reveals too much (e.g. "unsafe-url" or "no-referrer-when-downgrade"). Switch to a more privacy-friendly setting.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

⚠ Replace the existing Referrer-Policy line.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

⚠ Replace the existing Referrer-Policy entry.

✓ How to verify it works: F12 → Network → Response Header — new value visible.

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

0 MIME Type Protection

No MIME type protection (X-Content-Type-Options missing). Browsers may misinterpret files.

☛ Action needed: Add the header X-Content-Type-Options: nosniff. This prevents browsers from misinterpreting files, which can lead to security vulnerabilities. Your hosting provider or web developer can set this up in minutes.

▸ How to fix this — step-by-step guide

Without the "X-Content-Type-Options: nosniff" header the browser guesses file types from content — which attackers can exploit (e.g. a HTML file disguised as .jpg is executed as HTML). The fix is one single line.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
</IfModule>

⚠ No side effects expected — considered a safe standard and best practice for years.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
</IfModule>

⚠ Safe to add alongside other Header set entries.

Option 2: via functions.php in the child theme (Advanced alternative)

File: functions.php of your CHILD theme

add_action('send_headers', function () {
    header('X-Content-Type-Options: nosniff');
});

⚠ Back up functions.php before edits.

✓ How to verify it works: F12 → Network → Response Header: "x-content-type-options: nosniff".

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

100 Clickjacking Protection

Clickjacking protection active: X-Frame-Options = SAMEORIGIN.

50 Permissions (Camera, Microphone, etc.)

Permissions-Policy is configured — access to sensitive device APIs is controlled.

90 Cookies

1 first-party and 0 third-party cookie(s).

1 of 1 cookie(s) without SameSite protection — sent with requests from other websites.

☛ Action needed: Set the SameSite attribute (Lax or Strict) for all cookies. This prevents cookies from being sent with requests from other websites (CSRF protection).

▸ How to fix this — step-by-step guide

Without "SameSite" cookies are sent on requests from foreign sites — the basis of CSRF attacks (a foreign page silently triggers actions in your name because the login cookie travels along). Set SameSite=Lax as a minimum.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always edit Set-Cookie "^(.*)$" "$1; SameSite=Lax" "expr=!(resp('Set-Cookie') -strmatch '*SameSite*')"
</IfModule>

⚠ SameSite=Lax is a good default. Strict is safer but breaks external links (user clicks from Google to your site — cookies are NOT sent, login is lost). None allows cross-site but requires "; Secure".

WordPress Special for WordPress: where to add this

Option 2: via functions.php in the child theme (Advanced alternative)

File: wp-config.php (above "/* That’s all, stop editing! */")

@ini_set('session.cookie_samesite', 'Lax');
@ini_set('session.cookie_secure', '1');
@ini_set('session.cookie_httponly', '1');

⚠ Sets SameSite/Secure/HttpOnly for PHP session cookies. WordPress login cookies have been SameSite=Lax since WP 6.2. Update older versions!

✓ How to verify it works: F12 → Application → Cookies → "SameSite" column should show "Lax" or "Strict" everywhere, not empty.

First-party cookies (from the website itself)

Name	Domain	Encrypted	Server only	SameSite
session_token	.xvideos.com	Yes	Yes	None

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

70 Local Storage (Web Storage)

1 localStorage and 0 sessionStorage item(s) found.

localStorage

Name	Value
thumbloadstats_vthumbs	{"21":[{"s":2,"d":61}],"23":[{"s":2,"d":59}],"last":{"s":2,"v":[61,59]},"t":1792

50 Third-Party Requests

66 request(s) to 6 different third-party servers.

6 third-party server(s) within the EU/EEA.

thumb-cdn77.xvideos-cdn.com 40 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://thumb-cdn77.xvideos-cdn.com/80f1298b-2717-4d50-9a50-0fa60aa8fcbf/6/xv_3_t.avif

https://thumb-cdn77.xvideos-cdn.com/28f131ff-1a5c-4fe9-9842-07e78439638e/6/xv_30_t.avif

https://thumb-cdn77.xvideos-cdn.com/1870f289-648c-4df7-82e7-6be1d5740492/6/xv_30_t.avif

https://thumb-cdn77.xvideos-cdn.com/e45b2e52-b766-48b9-a530-9896647acb71/6/xv_9_t.avif

https://thumb-cdn77.xvideos-cdn.com/da697ec8-f53b-4a38-93aa-cd6c7da36829/6/xv_18_t.avif

https://thumb-cdn77.xvideos-cdn.com/7e031bfa-2bc6-412c-bc97-a195e72134e0/3/xv_20_t.avif

https://thumb-cdn77.xvideos-cdn.com/5dbfaf57-b99a-4bc1-a844-6dde71639273/6/xv_29_t.avif

https://thumb-cdn77.xvideos-cdn.com/6d6660e7-bd95-40db-b1af-77b2e45a3dbe/6/xv_12_t.avif

https://thumb-cdn77.xvideos-cdn.com/51c353f1-f057-46be-b362-c4d7c16e0101/6/xv_26_t.avif

https://thumb-cdn77.xvideos-cdn.com/ceaf070a-e1d1-4f27-9672-5aede6a9e9fd/6/xv_30_t.avif

https://thumb-cdn77.xvideos-cdn.com/5505f29a-01f9-466b-ae4e-335ee739ad48/6/xv_10_t.avif

https://thumb-cdn77.xvideos-cdn.com/9022bddc-b391-425e-97c0-f2cd22189786/6/xv_30_t.avif

https://thumb-cdn77.xvideos-cdn.com/f93abcf8-cd06-454a-88aa-23bec1b91e08/6/xv_1_t.avif

https://thumb-cdn77.xvideos-cdn.com/739dbad4-a103-4f64-a938-fc34a8daea33/6/xv_30_t.avif

https://thumb-cdn77.xvideos-cdn.com/95daef40-5ef5-4083-af0e-de390a18c24f/6/xv_19_t.avif

https://thumb-cdn77.xvideos-cdn.com/eb17085e-7b9f-4101-8d05-6281acc142e4/6/xv_11_t.avif

https://thumb-cdn77.xvideos-cdn.com/fe775403-d3f7-432d-94ec-cb3f2e6dc34c/6/xv_16_t.avif

https://thumb-cdn77.xvideos-cdn.com/38e509c0-0611-412f-ab48-962b5ed88d38/6/xv_19_t.avif

https://thumb-cdn77.xvideos-cdn.com/89de4dd2-7a22-4d76-9357-16719a1dfc85/6/xv_29_t.avif

https://thumb-cdn77.xvideos-cdn.com/e88061d1-e6a3-45ae-b7ad-552f23288af0/6/xv_12_t.avif

... and 20 more request(s)

assets-o7.xvideos-cdn.com 14 Requests · Netherlands (NL) · EU/EEA

Requested URLs:

https://assets-o7.xvideos-cdn.com/v-b95aa40ff47/v3/css/default/main.css

https://assets-o7.xvideos-cdn.com/v-9a4f1a51a62/v3/js/skins/min/default.footer.static.js

https://assets-o7.xvideos-cdn.com/v-88a2460474f/v3/js/skins/min/default.header.static.js

https://assets-o7.xvideos-cdn.com/img/lightbox/lightbox-blank.gif

https://assets-o7.xvideos-cdn.com/v3/js/skins/min/require.static.js

https://assets-o7.xvideos-cdn.com/v3/js/libs/jquery.min.js

https://assets-o7.xvideos-cdn.com/v3/img/skins/default/logo/xvideos.black.svg

https://assets-o7.xvideos-cdn.com/v-100d17b6f12/v3/js/i18n/front/english.json

https://assets-o7.xvideos-cdn.com/v-b95aa40ff47/v3/img/flags/flat/flags-16.png

https://assets-o7.xvideos-cdn.com/v-02605211619/v3/fonts/skins/common/iconfont/iconfont.woff2

https://assets-o7.xvideos-cdn.com/v-26b0514912c/v3/js/skins/min/default.js

https://assets-o7.xvideos-cdn.com/v3/img/skins/default/xv-inline-loader.gif

https://assets-o7.xvideos-cdn.com/v3/img/skins/default/logo/xv.white.svg

https://assets-o7.xvideos-cdn.com/v-26b0514912c/v3/js/jquery.js

thumbs-gcore.xvideos-cdn.com 8 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://thumbs-gcore.xvideos-cdn.com/0cc16362-08c3-4693-82df-662742d5f5e8/6/xv_13_t.avif

https://thumbs-gcore.xvideos-cdn.com/05e4f1ef-af8d-42bc-b1aa-fc241bf402bb/6/xv_10_t.avif

https://thumbs-gcore.xvideos-cdn.com/78fbf3c8-56da-4f1b-a52d-392f5f0cfe21/6/xv_28_t.avif

https://thumbs-gcore.xvideos-cdn.com/cfcebe52-b793-411c-988f-1852fa11c95e/6/xv_30_t.avif

https://thumbs-gcore.xvideos-cdn.com/29a65a42-c9bb-4782-b527-702dd66d2fbc/6/xv_12_t.avif

https://thumbs-gcore.xvideos-cdn.com/0a732b56-c009-4645-a302-956f882385cf/6/xv_29_t.avif

https://thumbs-gcore.xvideos-cdn.com/e8bccaef-7c36-4c26-ba27-e190bc802454/6/xv_28_t.avif

https://thumbs-gcore.xvideos-cdn.com/b3fbf588-3db0-4919-bf0a-37624d8cb991/6/xv_4_t.avif

s.pemsrv.com 2 Requests · Netherlands (NL) · EU/EEA

Requested URLs:

https://s.pemsrv.com/v1/api.php

https://s.pemsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAA11QW04DMQy8Chfoyu8k/YYToB5gN7vAfrRF3aoqkg+PE6EK0CRWnDgzYxOQ7RB2aE/Ee6U9sac8iA00oIg/vxxc0O+3dV7O21DPR8/ZipEbW+biGSQru5akksgVsmdJaGqOwsJkZi7g5BAQE0B

a.pemsrv.com 1 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://a.pemsrv.com/ad-provider.js

z6v2p9a8.bkcdn.net 1 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://z6v2p9a8.bkcdn.net/library/886962/c1525b168c8dd6adab61f46cff7f442708ae52c2.webp

100 Tracker Detection

No known trackers detected.

0 External Resource Integrity (SRI)

0 of 8 external resource(s) use integrity verification (SRI).

☛ Action needed: Not all external resources have integrity verification. Add SRI hashes for the missing resources.

▸ How to fix this — step-by-step guide

Only some of your external resources (0 of 8) are protected by SRI. Add integrity attributes to the remaining ones too.

WordPress Special for WordPress: where to add this

WordPress plugin: Approach: view page source → all <script src="https://…"> and <link href="https://…"> without integrity attribute → generate hash at https://www.srihash.org/ → add integrity="sha384-…" crossorigin="anonymous". Plugin "WP-SRI" automates many cases.

✓ How to verify it works: F12 → Console on page load: no "Failed to find a valid digest" messages. Source: all external <script>/<link> have an integrity attribute.

No external resources use integrity verification. Tampered files would not be detected.

☛ Action needed: Add Subresource Integrity (SRI) for all external scripts and stylesheets. This allows the browser to detect if an external file has been tampered with. Your web developer can easily generate the integrity attributes.

▸ How to fix this — step-by-step guide

SRI (Subresource Integrity) is a checksum in HTML that defines what an externally loaded file MUST look like. If someone tampers with the external file (e.g. a CDN gets compromised), the browser refuses to load it. You add the "integrity" attribute on the script/link tag.

WordPress Special for WordPress: where to add this

WordPress plugin: In WordPress you can rarely add SRI hashes manually (scripts are queued via wp_enqueue_script()). Plugin "WP-SRI" (in the plugin directory) adds integrity hashes automatically for external scripts/styles. For statically embedded resources in your theme: generate the hash at https://www.srihash.org/, add integrity="sha384-…" and crossorigin="anonymous" on the <script>/<link> tag.

✓ How to verify it works: F12 → Network → requests with status 200 from CDN domains (cdn.jsdelivr.net, cdnjs.cloudflare.com etc.) → in HTML source the tag must contain "integrity=\"sha384-…\" crossorigin=\"anonymous\"".

65 DNS Security

No CAA records. Any certificate authority could issue a certificate for this domain.

☛ Action needed: Create CAA DNS records to specify which certificate authorities may issue certificates for your domain. This prevents unauthorized certificates from being issued.

▸ How to fix this — step-by-step guide

CAA records (Certification Authority Authorization) define in DNS which Certificate Authorities are allowed to issue certificates for your domain. Without a CAA record an attacker could request a fraudulent certificate for your domain at any CA. CAA is pure DNS configuration — set in your registrar/DNS-panel, NOT in WordPress.

☞ Concrete CAA values for the ten most common DACH-region hosts

Find your host in the table, copy the values to your DNS panel. For multi-CA hosts: one separate CAA record per CA (all with tag issue, flag 0, name @). Additionally recommended: an iodef record with a contact email for abuse reports.

#	Host	CA(s) used	CAA value(s) — tag `issue`
1	Hetzner Webhosting (basic certificate, free in package)	DigiCert (programme „Encryption Everywhere")	`digicert.com`
1	Hetzner Webhosting (Let’s Encrypt, free)	Let’s Encrypt (ISRG)	`letsencrypt.org`
2	All-Inkl	Let’s Encrypt + Sectigo (Pro)	`letsencrypt.org` `sectigo.com`
3	IONOS (1&1)	DigiCert (GeoTrust) + Let’s Encrypt	`digicert.com` `letsencrypt.org`
4	STRATO	Sectigo + Let’s Encrypt	`sectigo.com` `letsencrypt.org`
5	Cloudflare (Universal SSL)	Google Trust Services + DigiCert + Let’s Encrypt	`pki.goog` `digicert.com` `letsencrypt.org`
6	AWS (ACM / CloudFront)	Amazon Trust Services	`amazon.com` `amazontrust.com` `awstrust.com` `amazonaws.com`
7	Mittwald	Let’s Encrypt + Sectigo	`letsencrypt.org` `sectigo.com`
8	Webgo	Let’s Encrypt + Sectigo	`letsencrypt.org` `sectigo.com`
9	raidboxes (Managed WordPress)	Let’s Encrypt	`letsencrypt.org`
10	Host Europe / DomainFactory	Sectigo + Let’s Encrypt	`sectigo.com` `letsencrypt.org`

Name   Type   Flag   Tag      Value
@      CAA    0      issue    "digicert.com"
@      CAA    0      issue    "letsencrypt.org"
@      CAA    0      iodef    "mailto:security@your-domain.com"

The iodef line (last line) is optional but recommended: CAs report abuse attempts to that address. For subdomains (e.g. shop.your-domain.com) create separate records with the subdomain name instead of @ — modern CAs check parent CAA automatically though.

If your host is not on the list: open your current certificate in the browser (padlock → certificate → issuer). The CA name is shown there (e.g. "Sectigo RSA Domain Validation Secure Server CA" → value sectigo.com). Add that as a CAA record, done.

WordPress Special for WordPress: where to add this

WordPress plugin: CAA records are NOT created in WordPress but in your domain registrar / DNS provider panel (e.g. Hetzner-Robot, IONOS Domains, Cloudflare Dashboard, INWX, etc.). Common label: "CAA record" or under "TXT records" with type selector "CAA". One separate record per CA.

✓ How to verify it works: On https://www.ssllabs.com/ssltest/analyze.html?d=your-domain.com → "DNS CAA" section → all your CAs should be listed. Or via dig: dig CAA your-domain.com.

3 nameservers present — good redundancy.

No IPv6 support (no AAAA record).

☛ Action needed: Enable IPv6 support (AAAA records) for your domain. More and more users are using IPv6.

▸ How to fix this — step-by-step guide

Your domain has no IPv6 address (AAAA record). Over 40% of users (especially mobile) reach the internet via IPv6 — they must take the slower IPv4 gateway detour.

WordPress Special for WordPress: where to add this

WordPress plugin: Pure DNS + server matter. Step 1: check if your host has an IPv6 address for you (hosting panel or support ticket). Step 2: in the DNS panel create an AAAA record pointing to that IPv6. Step 3: test.

✓ How to verify it works: dig AAAA your-domain.com — or online https://ipv6-test.com/validate.php?url=your-domain.com.

SPF record present: v=spf1 mx ip4:79.127.140.143 ip4:79.127.140.144 ip4:79.127.140.145 include:_spf.google.com include:sendgrid.net include: — protects against email spoofing.

No DMARC record. The domain is vulnerable to email phishing.

☛ Action needed: Create a DMARC DNS record at _dmarc.yourdomain.com. DMARC protects against phishing and email spoofing. Example: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

▸ How to fix this — step-by-step guide

DMARC combines SPF and DKIM into an explicit instruction for receiving mail servers: "What to do if emails claim to come from us but SPF/DKIM fail?" Without DMARC each server decides — usually generously. With DMARC=reject you effectively prevent phishing in your name.

WordPress Special for WordPress: where to add this

WordPress plugin: DNS matter. TXT record at subdomain _dmarc.your-domain.com. Recommended stages: Observe first: v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain.com — review reports for weeks. Then tighten: v=DMARC1; p=quarantine; rua=… — suspicious mails go to spam. Final: v=DMARC1; p=reject; rua=… — they’re refused outright.

✓ How to verify it works: dig TXT _dmarc.your-domain.com — or online https://dmarcian.com/dmarc-inspector/.

100 Security Contact (security.txt)

security.txt found: https://www.xvideos.com/.well-known/security.txt

Contact field present (required) — security researchers can report vulnerabilities.

Expires field present (required).

100 External Reporting Endpoints

No external reporting endpoints detected.

85 Cookie Consent

Cookie consent system detected: TCF API (__tcfapi).

TCF-compliant consent system (Transparency & Consent Framework) — IAB standard.

Consent system detected, but banner does not appear to be visible.

☛ Action needed: The consent system does not appear to be visible. Ensure the cookie banner is displayed on the first visit and is not hidden by CSS or JavaScript.

▸ How to fix this — step-by-step guide

Your consent system is wired up but the banner doesn’t appear visibly — perhaps hidden by another plugin or custom CSS. Risk: without a visible banner, no consent is given.

WordPress Special for WordPress: where to add this

WordPress plugin: Approach: 1) clear browser cache + cookies, use incognito. 2) In the consent plugin: check display conditions (e.g. "only EU visitors" — and you’re testing from a non-EU server). 3) F12 → Console for red errors from consent scripts. 4) Inspector → search DOM for "cookie", "consent" — element present but display:none? z-index too low? 5) Uninstall conflicting cookie-notice plugins.

✓ How to verify it works: Incognito tab, load page, wait 5 seconds — banner visible centered/bottom, doesn’t fully block main content, is clickable.

100 Privacy Policy & Legal Notice

Legal notice linked: "Privacy notice" (https://info.xvideos.net/legal/privacynotice).

⚙ Your ready-to-use security .htaccess

All missing security headers combined into one block. Append this block to the end of your .htaccess — done. 5 headers will be set.

⚠ Why this recommendation does NOT give a 100% score — and why that's how it is with WordPress

The Content-Security-Policy above deliberately includes 'unsafe-inline' for both style-src and script-src. This does NOT provide full XSS protection — it's a pragmatic trade-off, not a bug.

Why? A typical WordPress setup (theme + 5-15 plugins) emits 10-50 different inline <script> blocks into the HTML: jQuery init, slider init, cookie banner, tracking, GTM, web vitals, lazy-load, speculation rules and so on. A strict script-src 'self' blocks them all — the site becomes visually and functionally broken (blank slider, broken cookie banner, dead plugins).

Consequence for scoring: Sites running WordPress with plugins can score at most ~75-85 points in the CSP category in this app — the full 100% rating is only achievable when inline code is signed via nonce or hash (technically demanding, breaks on every theme/plugin update).

Paths to full XSS protection (in increasing complexity):

Plugin "WP Content Security Policy & Headers" — automatically adds nonces to inline scripts (medium effort, cleanest WP solution).
Hash-based CSP — whitelist every inline script via SHA-256 in the CSP (fragile, breaks on updates).
Externalize inline scripts — rebuild theme/plugins so no inline JS is emitted (huge effort, often impossible).

Anyone who doesn't take one of these paths lives with 'unsafe-inline' — like about 95% of all production WordPress sites on the web. The other CSP directives still protect: default-src 'self' blocks external resources, object-src 'none' bans Flash/Java, frame-ancestors 'self' prevents clickjacking, base-uri 'self' prevents base-tag hijacking. Not maximum protection, but realistic protection for WP reality.

⚠ Important on Hetzner-Konsoleh webhosting (managed / shared hosting)

On Hetzner-Konsoleh webhosting (and comparable shared hosts like All-Inkl, IONOS, Strato, 1blu, …), Apache throws a 500 Internal Server Error as soon as Header always edit Set-Cookie … expr=… appears in .htaccess. The Apache error log says:

Can't parse envclause/expression: syntax error, unexpected T_OP_STR_EQ, expecting $end

This is not a WebForensik bug and not a typo — the shared host has blocked the mod_headers expr= subset via AllowOverride limits (for security, because Header edit could also manipulate cookies of other tenants).

☛ For Hetzner-Konsoleh users: use the variant below marked with the red "Hetzner / Shared" badge. It consists of two files (.htaccess + wp-config.php) instead of one, but avoids the 500 error reliably. Cookie flags go into wp-config.php instead of .htaccess.

Apache Standard Apache (any host, without WordPress)

Append this block to the end of your .htaccess in the web root — done.

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Content-Type-Options "nosniff"

    # Fehlende Cookie-Flags konditional ergänzen (nur wenn nicht schon gesetzt)
    Header always edit Set-Cookie "^(.*)$" "$1; SameSite=Lax" "expr=!(resp('Set-Cookie') -strmatch '*SameSite*')"
</IfModule>

Hetzner / Shared Hetzner-Konsoleh / Managed Hosting (two files)

This variant avoids the 500 Internal Server Error on Hetzner-Konsoleh and similar shared hosts (All-Inkl, IONOS, Strato, 1blu …): the .htaccess only contains the header directives (no "Header edit"), cookie flags move into wp-config.php. Two files to edit instead of one, but guaranteed to run.

1. File: .htaccess in the WordPress root

# BEGIN WebForensik Security
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Content-Type-Options "nosniff"
</IfModule>
# END WebForensik Security

2. File: wp-config.php in the WordPress root

Insert ABOVE the line "/* That's all, stop editing! */". Back up wp-config.php first!

// === WebForensik: Cookie-Hardening (Hetzner-Konsoleh-tauglich) ===
// Bitte OBERHALB der Zeile "/* That's all, stop editing! */" einfügen.
// Wirkt auf PHP-Session- und WordPress-Login-Cookies.
// Plugin-eigene Cookies (z.B. WooCommerce, Cookie-Banner) müssen in den
// Plugin-Einstellungen separat auf "Secure" gestellt werden.
@ini_set('session.cookie_samesite', 'Lax');

WordPress WordPress: .htaccess in WP root

Insert this block ABOVE the "# BEGIN WordPress" line, otherwise WP overwrites it on permalink changes.

# BEGIN WebForensik Security
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Content-Type-Options "nosniff"

    # Fehlende Cookie-Flags konditional ergänzen
    Header always edit Set-Cookie "^(.*)$" "$1; SameSite=Lax" "expr=!(resp('Set-Cookie') -strmatch '*SameSite*')"
</IfModule>
# END WebForensik Security

WordPress Alternative for WordPress: functions.php in child theme

If your host disallows .htaccess changes: append this PHP snippet to the end of your CHILD theme's functions.php. Back up first — NEVER edit the parent theme, it gets overwritten on updates.

add_action('send_headers', function () {
    header("Strict-Transport-Security: max-age=31536000; includeSubDomains");
    header("Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests");
    header("Referrer-Policy: strict-origin-when-cross-origin");
    header("X-Content-Type-Options: nosniff");
});

// Cookie-Flags für PHP-Session-Cookies — wirkt nur auf $_SESSION,
// NICHT auf von Plugins/Themes per setcookie() gesetzte Cookies.
// Für umfassende Cookie-Absicherung die .htaccess-Variante oben verwenden.
add_action('init', function () {
    if (headers_sent()) return;
    @ini_set('session.cookie_samesite', 'Lax');
}, 1);

Dry-run — we re-load your site with the proposed headers and show which resources would be blocked. Takes about 30 seconds.

HTTP Response Headers

Header	Value
accept-ch	Viewport-Width, Width, Device-Memory, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness
content-encoding	gzip
content-length	21651
content-security-policy	default-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: yoti: .xvideos.com .xnxx.com .red-cdn.com .gold-cdn.com .xvideos-cdn.com .xnxx-cdn.com .others-cdn.com 1868565294.rsc.cdn77.org static.cloudflareinsights.com www.google.com www.gstatic.com fonts.gstatic.com global.frcapi.com .googl
content-type	text/html; charset=utf-8
cross-origin-opener-policy	same-origin-allow-popups
date	Sat, 17 Oct 2026 03:52:23 GMT
p3p	policyref="/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
permissions-policy	ch-ua-model=(self "https://s.orbsrv.com" "https://s.pemsrv.com" "https://s.zikmlg.com"), ch-ua-platform-version=(self "https://s.orbsrv.com" "https://s.pemsrv.com" "https://s.zikmlg.com")
referrer-policy	no-referrer-when-downgrade
report-to	{"group": "csp-endpoint", "max_age": 10886400, "endpoints": [ { "url": "https://www.xvideos.com/csp-reports" } ] }
server	nginx
set-cookie	session_token=3f16e0d6d9a5daedmLMtIB5822m_wBWNPg_iMOPt0hW7iZe0FJ6toRydWsx-znOVXvtGi7VzhwbWnhWcmwAuwv9aCei2rC-hDgjbDYHkcOw_eBLu7JjLtmecwZLBKxnxLVOfSY4rhMtf_fJXeOyfHUCndJVokeuEzFXU9ssO8uHJgcnT7JuVXKVCs3KjRXxB0UWdv312fK3eb5z8; expires=Mon, 16 Nov 2026 03:52:23 GMT; Max-Age=2592000; path=/; domain=.xvid
vary	Accept-Encoding,User-Agent,Accept-Language,Cookie
x-frame-options	SAMEORIGIN

New Scan · Compare

Embed your score on your website

Show your WebForensik score publicly. The badge is a lightweight SVG, loads fast, and respects your visitors' privacy (no tracking).

HTML code to embed (this specific scan)

<a href="https://webforensik.de/results.php?id=2893" target="_blank" rel="noopener">
  <img src="https://webforensik.de/badge.php?id=2893" alt="WebForensik Score" width="174" height="28">
</a>

Or dynamically — always shows the latest scan of this domain

<a href="https://webforensik.de/?url=https://xvideos.com" target="_blank" rel="noopener">
  <img src="https://webforensik.de/badge.php?domain=xvideos.com" alt="WebForensik Score" width="174" height="28">
</a>