WebForensik
Results for https://digitaler-pflegeantrag.de/
Scan time: 2026-08-13 11:05:34
Overall Score
⚠ This website has serious GDPR deficiencies. Immediate action is required.
GDPR Issues Detected (2):
❌ 2 third-party server(s) outside the EU/EEA — data transfers without legal basis may violate Art. 44–49 GDPR.
Affected servers outside the EU:
- stats.g.doubleclick.net (United States)
- www.google.com (United States)
❌ 1 tracking service(s) detected — without prior consent (opt-in) this violates Art. 6(1) GDPR.
Detected trackers:
- Google (Content)
Note: This automated analysis does not replace legal advice. For a complete GDPR assessment, consult a data protection officer.
↓ See detailed results for each category below.
The website uses an encrypted connection (HTTPS).
Latest encryption active (TLS 1.3 — TLSv1.3).
The security certificate is valid (expires 2026-10-06).
Strong encryption method (TLS_AES_256_GCM_SHA384, 256 bit).
HSTS is enabled — the browser is instructed to always use the encrypted connection.
HSTS duration: only 2592000 seconds — too short. At least 180 days recommended.
▸ How to fix this — step-by-step guide
Your HSTS max-age is too short (only 2592000 seconds) — browsers "forget" the HTTPS requirement quickly. Recommended: at least 180 days (15552000 seconds), preferably 1 year (31536000).
Apache server (classic hosting at most providers)
File: .htaccess in the web root
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>⚠ If another Strict-Transport-Security entry exists, replace it (don’t add a second one — only the first takes effect).
WordPress Special for WordPress: where to add this
Option 1: via .htaccess (recommended — no theme editing)
File: .htaccess in the WordPress root
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>⚠ Replace the existing HSTS entry in .htaccess with this line.
✓ How to verify it works: curl -I https://your-domain.com | grep -i strict — max-age must be at least 15552000.
HSTS also applies to all subdomains (includeSubDomains).
Content Security Policy present (via HTTP-Header).
Script sources are too broad (wildcard, http:, etc.) — practically no protection.
▸ How to fix this — step-by-step guide
Your script-src is so broad (wildcard *, http:, …) that practically any code can be loaded — protection is effectively zero. You need to list allowed domains explicitly.
Apache server (classic hosting at most providers)
File: .htaccess in the web root
<IfModule mod_headers.c>
Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
</IfModule>⚠ After "script-src 'self'" list only domains you actually need. Step-by-step approach: remove all wildcards, reload, F12 console shows blocked domain → add → repeat. The other directives (img-src data:, style-src 'unsafe-inline') are kept pragmatic so WordPress emoji, admin bar and plugin inline-styles don't break.
WordPress Special for WordPress: where to add this
Option 1: via .htaccess (recommended — no theme editing)
File: .htaccess in the WordPress root
<IfModule mod_headers.c>
Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
</IfModule>⚠ Add domains after "script-src 'self'" as needed (space-separated, prefixed with https://). IMPORTANT: img-src data: and style-src 'unsafe-inline' MUST stay — without them WordPress emoji, admin-bar icons and plugin inline-styles will break.
✓ How to verify it works: F12 → Console. If something is blocked: "Refused to load the script ‘https://…’" — identify the URL, add its domain to script-src, reload.
Embedding protection (frame-ancestors) is configured — protects against clickjacking.
Good base rule: only own content is allowed by default (default-src: self).
Referrer-Policy: strict-origin-when-cross-origin (via HTTP-Header).
Strict setting "strict-origin-when-cross-origin" — no path leak, no HTTP downgrade leak. Best practice.
MIME type protection active (nosniff) — browsers will not misinterpret files.
Clickjacking protection active via CSP frame-ancestors.
Permissions-Policy is configured — access to sensitive device APIs is controlled.
6 of 6 sensitive APIs restricted — very good.
2 first-party and 0 third-party cookie(s).
First-party cookies (from the website itself)
| Name | Domain | Encrypted | Server only | SameSite |
|---|---|---|---|---|
| cfzs_google-analytics_v4 | .digitaler-pflegeantrag.de | Yes | Yes | Lax |
| cfz_google-analytics_v4 | .digitaler-pflegeantrag.de | Yes | Yes | Lax |
No local storage (Web Storage) used — no tracking risk.
5 request(s) to 4 different third-party servers.
2 third-party server(s) outside the EU/EEA — potentially problematic for GDPR compliance.
▸ How to fix this — step-by-step guide
GDPR-relevant: visitor data (at least IP + User-Agent) is transmitted to servers outside the EU/EEA. Since the Schrems-II ruling (2020) this requires Standard Contractual Clauses + supplementary technical measures AND prior consent. Best fix: replace with EU alternatives where possible.
WordPress Special for WordPress: where to add this
WordPress plugin: Common culprits and EU alternatives: Google Fonts → Bunny Fonts or self-host (plugin "OMGF — Host Google Fonts Locally"). Google Analytics → Matomo (self-hosted) or Plausible (EU servers). Google reCAPTCHA → hCaptcha (EU) or Friendly Captcha. Google Maps → OpenStreetMap. YouTube embeds → plugin "WP YouTube Lyte" loads only after click. CDN: Cloudflare → BunnyCDN (EU) or KeyCDN.
✓ How to verify it works: Load in incognito mode, F12 → Network → list all requests → check "Domain" column for non-EU servers. After migration no unrequested US domains should load.
2 third-party server(s) within the EU/EEA.
Requested URLs:
https://versandhandel.dimdi.de/img/logo.png
https://versandhandel.dimdi.de/img/logo.gif
Requested URLs:
https://static.cloudflareinsights.com/beacon.min.js/v4513226cdae34746b4dedf0b4dfa099e1781791509496
Requested URLs:
https://stats.g.doubleclick.net/g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-8RFV54ELLS&cid=07ced2a1-9ac0-4663-a00a-4a11a6ab2522&_u=KGDAAEADQAAAAC%7E&z=821812490
Requested URLs:
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&v=1&_v=j86&tid=G-8RFV54ELLS&cid=07ced2a1-9ac0-4663-a00a-4a11a6ab2522&_u=KGDAAEADQAAAAC%7E&z=821812490&slf_rd=1
1 known tracker(s) detected! These track visitors across different websites.
▸ How to fix this — step-by-step guide
Trackers (Google Analytics, Facebook Pixel, …) capture visitors and follow them across multiple sites. Under GDPR Art. 6 and ePrivacy / national implementations, explicit consent is required BEFORE loading the tracker. "Continued scrolling = consent" is NOT acceptable.
WordPress Special for WordPress: where to add this
WordPress plugin: Consent plugins that properly block trackers until consent: "Complianz" (free, very good), "Real Cookie Banner", "Borlabs Cookie" (paid, most thorough). Principle after setup: do NOT embed the tracker snippet (e.g. GA script) directly in your theme — register it with the consent plugin, which only releases it after "Accept". Privacy-friendly tracker alternatives: Matomo (cookieless mode → may need no consent), Plausible (EU, anonymous, vendor claims no consent needed — legal advice recommended).
✓ How to verify it works: Incognito, load page — BEFORE "Accept": F12 → Network → no requests to google-analytics.com, facebook.com/tr etc. AFTER "Accept", yes.
Google (Content): www.google.com
1 of 1 external resource(s) use integrity verification (SRI).
CAA records present: comodoca.com, digicert.com; cansignhttpexchanges=yes, letsencrypt.org, pki.goog; cansignhttpexchanges=yes, ssl.com, comodoca.com, digicert.com; cansignhttpexchanges=yes, letsencrypt.org, pki.goog; cansignhttpexchanges=yes, ssl.com — only specified certificate authorities may issue certificates.
2 nameservers present — good redundancy.
IPv6 support present (AAAA records).
SPF record present: v=spf1 mx a include:spf.protection.outlook.com include:eu.transmail.net include:eu.zcsend.net include:usermail.zohocreat — protects against email spoofing.
DMARC record present: v=DMARC1; p=reject; — email authentication active.
security.txt found: https://digitaler-pflegeantrag.de/.well-known/security.txt
Contact field present (required) — security researchers can report vulnerabilities.
Expires field present (required).
Encryption information provided.
Preferred languages specified.
Network Error Logging (NEL) active — network errors are reported to an external service.
▸ How to fix this — step-by-step guide
Network Error Logging (NEL) reports network errors to an external server. As with external reporting: mention in privacy policy and verify GDPR compliance of the recipient.
Apache server (classic hosting at most providers)
File: .htaccess in the web root
<IfModule mod_headers.c>
Header always unset NEL
Header always unset Report-To
</IfModule>⚠ If you don’t actively need NEL: these two lines remove both reporting headers. If you do: document it in the privacy policy.
WordPress Special for WordPress: where to add this
Option 1: via .htaccess (recommended — no theme editing)
File: .htaccess in the WordPress root
<IfModule mod_headers.c>
Header always unset NEL
Header always unset Report-To
</IfModule>⚠ If headers come from a plugin, configure the plugin instead.
✓ How to verify it works: F12 → Network → first request → Response Header: NO "nel" or "report-to" anymore (or deliberately documented).
Data is reported to external service: Report-To: a.nel.cloudflare.com
▸ How to fix this — step-by-step guide
Your site sends error or CSP reports to an external service (Report-To: a.nel.cloudflare.com). GDPR-relevant: at least IP address and URL are transmitted. Verify (a) the recipient is GDPR-compliant, (b) the transfer is mentioned in your privacy policy, (c) a data processing agreement (DPA) exists.
WordPress Special for WordPress: where to add this
WordPress plugin: If you didn’t set up the reporting endpoint yourself, it usually comes from a plugin (e.g. Sentry, Rollbar, Datadog). Check the plugin configuration — either disable, replace with an EU vendor, or gate behind consent.
✓ How to verify it works: Privacy policy contains an entry about error reporting + DPA is in place. In incognito: F12 → Network → no unintended reporting requests.
Cookie consent system detected: TCF API (__tcfapi), Borlabs Cookie, borlabs.
TCF-compliant consent system (Transparency & Consent Framework) — IAB standard.
Consent system detected, but banner does not appear to be visible.
▸ How to fix this — step-by-step guide
Your consent system is wired up but the banner doesn’t appear visibly — perhaps hidden by another plugin or custom CSS. Risk: without a visible banner, no consent is given.
WordPress Special for WordPress: where to add this
WordPress plugin: Approach: 1) clear browser cache + cookies, use incognito. 2) In the consent plugin: check display conditions (e.g. "only EU visitors" — and you’re testing from a non-EU server). 3) F12 → Console for red errors from consent scripts. 4) Inspector → search DOM for "cookie", "consent" — element present but display:none? z-index too low? 5) Uninstall conflicting cookie-notice plugins.
✓ How to verify it works: Incognito tab, load page, wait 5 seconds — banner visible centered/bottom, doesn’t fully block main content, is clickable.
Trackers are loaded on page load — possibly BEFORE consent is given.
▸ How to fix this — step-by-step guide
Your trackers are loaded BEFORE the user can consent ("pre-consent loading"). Common misconfiguration in cookie plugins — banner appears, but too late: the GA script is already running. Violates ePrivacy.
WordPress Special for WordPress: where to add this
WordPress plugin: Almost always caused by the theme or a tracking plugin that embeds the tracker code directly (e.g. "Google Analytics for WordPress" with auto-insert). Fix: 1) remove tracking code from the theme/plugin. 2) In the consent plugin (Complianz/Real Cookie Banner): register the tracker as a "service", paste the snippet there — the plugin will load it only after consent. 3) ALTERNATIVELY: plugin "PYS PixelYourSite" combined with consent gating. Do NOT rely on "GA anonymized before consent" — legally unsettled and risky.
✓ How to verify it works: Incognito → F12 → Network (clear all, start recording) → load page, do NOT click banner, wait 10 seconds → there must be NO requests to google-analytics.com, googletagmanager.com, facebook.com/tr, doubleclick.net etc.
Privacy policy linked: "Datenschutzerklärung" (https://digitaler-pflegeantrag.de/datenschutzerklarung/).
Legal notice linked: "Impressum" (https://digitaler-pflegeantrag.de/impressum/).
Privacy policy page is accessible (HTTP 200).
⚙ Your ready-to-use security .htaccess
All missing security headers combined into one block. Append this block to the end of your .htaccess — done. 2 headers will be set.
⚠ Why this recommendation does NOT give a 100% score — and why that's how it is with WordPress
The Content-Security-Policy above deliberately includes 'unsafe-inline' for both style-src and script-src. This does NOT provide full XSS protection — it's a pragmatic trade-off, not a bug.
Why? A typical WordPress setup (theme + 5-15 plugins) emits 10-50 different inline <script> blocks into the HTML: jQuery init, slider init, cookie banner, tracking, GTM, web vitals, lazy-load, speculation rules and so on. A strict script-src 'self' blocks them all — the site becomes visually and functionally broken (blank slider, broken cookie banner, dead plugins).
Consequence for scoring: Sites running WordPress with plugins can score at most ~75-85 points in the CSP category in this app — the full 100% rating is only achievable when inline code is signed via nonce or hash (technically demanding, breaks on every theme/plugin update).
Paths to full XSS protection (in increasing complexity):
- Plugin "WP Content Security Policy & Headers" — automatically adds nonces to inline scripts (medium effort, cleanest WP solution).
- Hash-based CSP — whitelist every inline script via SHA-256 in the CSP (fragile, breaks on updates).
- Externalize inline scripts — rebuild theme/plugins so no inline JS is emitted (huge effort, often impossible).
Anyone who doesn't take one of these paths lives with 'unsafe-inline' — like about 95% of all production WordPress sites on the web. The other CSP directives still protect: default-src 'self' blocks external resources, object-src 'none' bans Flash/Java, frame-ancestors 'self' prevents clickjacking, base-uri 'self' prevents base-tag hijacking. Not maximum protection, but realistic protection for WP reality.
Apache Standard Apache (any host, without WordPress)
Append this block to the end of your .htaccess in the web root — done.
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
</IfModule>WordPress WordPress: .htaccess in WP root
Insert this block ABOVE the "# BEGIN WordPress" line, otherwise WP overwrites it on permalink changes.
# BEGIN WebForensik Security
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
</IfModule>
# END WebForensik SecurityWordPress Alternative for WordPress: functions.php in child theme
If your host disallows .htaccess changes: append this PHP snippet to the end of your CHILD theme's functions.php. Back up first — NEVER edit the parent theme, it gets overwritten on updates.
add_action('send_headers', function () {
header("Strict-Transport-Security: max-age=31536000; includeSubDomains");
header("Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests");
});| Header | Value |
|---|---|
| alt-svc | h3=":443"; ma=86400 |
| cf-cache-status | DYNAMIC |
| cf-ray | a2a68ee54efcd114-CDG |
| content-encoding | br |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; connect-src 'self' https:; frame-src https:; frame-ancestors 'self' https://pflegeantrag.de https://enkian-solutions. |
| content-type | text/html; charset=UTF-8 |
| date | Thu, 13 Aug 2026 09:05:27 GMT |
| expect-ct | max-age=86400, enforce |
| last-modified | Thu, 13 Aug 2026 07:39:11 GMT |
| link | <https://digitaler-pflegeantrag.de/wp-json/>; rel="https://api.w.org/", <https://digitaler-pflegeantrag.de/wp-json/wp/v2/pages/3440>; rel="alternate"; title="JSON"; type="application/json", <https://digitaler-pflegeantrag.de/>; rel=shortlink |
| nel | {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} |
| permissions-policy | geolocation=(), microphone=(), camera=(), payment=(), usb=(), interest-cohort=() |
| referrer-policy | strict-origin-when-cross-origin |
| report-to | {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nMe1L3LgG6Tv5YFuEhI%2BqvPIqX3c69NXWSpJSIhZtRUDAdlWShjTjA0QbLJYpZZq9RGNC%2B8g60JgzWgikbcP0Ps%2BO3CtJ%2F6S7vEpPbLwsNMz6TjqEACSYZ34HIP%2FODU3MyV2EkLu1hhU8yPXfKYjFXy4MSliJ8U%3D"}]} |
| server | cloudflare |
| server-timing | cfCacheStatus;desc="DYNAMIC" cfEdge;dur=71,cfOrigin;dur=0 |
| strict-transport-security | max-age=2592000; includeSubDomains |
| vary | Accept-Encoding |
| x-cache | HIT |
| x-cache-enabled | true |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| x-xss-protection | 1; mode=block |
Embed your score on your website
Show your WebForensik score publicly. The badge is a lightweight SVG, loads fast, and respects your visitors' privacy (no tracking).
HTML code to embed (this specific scan)
<a href="https://webforensik.de/results.php?id=985" target="_blank" rel="noopener">
<img src="https://webforensik.de/badge.php?id=985" alt="WebForensik Score" width="174" height="28">
</a>Or dynamically — always shows the latest scan of this domain
<a href="https://webforensik.de/?url=https://digitaler-pflegeantrag.de" target="_blank" rel="noopener">
<img src="https://webforensik.de/badge.php?domain=digitaler-pflegeantrag.de" alt="WebForensik Score" width="174" height="28">
</a>