DevOpser CRM

Self-hosted form endpoints plus a light email CRM (capture, autoresponders, broadcasts, one-click unsubscribes), so you own your forms and your list.

crm.devopser.io security headers A 90/100

software · added 2026-09-25

Compare

Security headers: A, 90 out of 100

Number 8 of 95 in the ranking. Missing 1 of the 9 headers we check.

Meets the B minimum (70/100) in our RFP clause.

Missing 1

Permissions-Policy 0 of 10

Switches off browser features the product does not use, such as camera, microphone, location and payments, for the page and anything embedded in it.

Without it: Any script or iframe on the page, including third-party ads and chat widgets, can ask the user for camera, microphone or location access under the vendor's name.

Sent 8

Content-Security-Policy 25 of 25

default-src 'self';script-src 'self';style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https://placehold.co https://*.cloudfront.net;connect-src 'self' https://*.amazonaws.com;font-src 'self' https://fonts.gstatic.com;object-src 'none';media-src 'self';frame-src 'self';script-src-attr 'none';form-action 'self';base-uri 'self';frame-ancestors 'none'
Strict-Transport-Security 20 of 20

max-age=15552000; includeSubDomains; preload
X-Content-Type-Options 10 of 10

nosniff
Frame protection 10 of 10

DENY
Referrer-Policy 10 of 10

strict-origin-when-cross-origin
Cross-Origin-Opener-Policy 5 of 5

same-origin
Cross-Origin-Resource-Policy 5 of 5

same-origin
No version disclosure 5 of 5

server: envoy

Checked 2026-10-03 at https://crm.devopser.io/. Re-checked every 7 days. The grade covers the headers this website sends, not the product’s overall security. How the grade works.