https://bp.com
Security
· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.SCORE
89
GRADE
B
FIX
1
REVIEW
3
PASS
8
INFO
0
Checks
128 PASS 3 REVIEW 1 FIX
Dsecurity.txtActionNo /.well-known/security.txt publishedFIX
security.txt
ActionNo /.well-known/security.txt published
security.txt
No security.txt found at /.well-known/security.txt
BSecurity Headers7 of 10 headers properly configuredREVIEW
Security Headers
7 of 10 headers properly configured
7 of 10 headers properly configured
Warning::
HSTS is missing includeSubDomains
Without includeSubDomains, subdomains can still be accessed over HTTP.
Got: max-age=31536000 Expected: max-age=31536000; includeSubDomains
Info::
X-Content-Type-Options is properly configured
Got: nosniff
Info::
X-Frame-Options is properly configured
Got: SAMEORIGIN
Info::
Referrer-Policy is properly configured
Got: no-referrer-when-downgrade
Info::
Permissions-Policy is set
Got: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), usb=(), vr=(), wake-lock=(), xr-spatial-tracking=()
Info::
Content-Security-Policy is present
Got: default-src https: data: blob: 'self'; upgrade-insecure-requests; script-src 'un…
Warning::
Cross-Origin-Opener-Policy header is missing
COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.
Expected: same-origin
Warning::
Cross-Origin-Embedder-Policy header is missing
COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
Expected: require-corp
Info::
X-Powered-By header is not present
Info::
Server header is present without version info
Got: Apache
Without includeSubDomains, subdomains can still be accessed over HTTP.
Expected:
max-age=31536000; includeSubDomainsWhy this matters
Without includeSubDomains, a forgotten dev subdomain over HTTP can set malicious cookies that ride to the apex.
Learn more ▾ ▴
HSTS without includeSubDomains protects only the exact domain. Cookies set on a non-HSTS subdomain can ride to the apex via cookie-scope attacks. The fix is one directive append. Verify all subdomains support HTTPS first — adding includeSubDomains to a domain with HTTP-only subdomains breaks them.
Source: RFC 6797
COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.
Expected:
same-originWhy this matters
COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.
Learn more ▾ ▴
Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.
Source: MDN / web.dev
COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
Expected:
require-corpWhy this matters
COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.
Learn more ▾ ▴
Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.
Source: MDN / web.dev
CContent Security PolicyAction5 of 10 CSP checks passedREVIEW
Content Security Policy
Action5 of 10 CSP checks passed
5 of 10 CSP checks passed
Info::
Raw CSP policy
Got: default-src https: data: blob: 'self'; upgrade-insecure-requests; script-src 'unsafe-eval' https: data: blob: 'self'; style-src 'unsafe-inline' 'unsafe-eval' https: data: blob: 'self'; img-src 'unsafe-inline' 'unsafe-eval' https: data: blob: 'self'
Info::
default-src directive is set
Got: default-src https: data: blob: 'self'
Info::
No 'unsafe-inline' in script source
Critical::
'unsafe-eval' found in script source
'unsafe-eval' allows eval() and similar functions, enabling code injection. Remove it.
Got: script-src 'unsafe-eval' https: data: blob: 'self'
Info::
No wildcard in script source
Info::
object-src falls back to default-src
Warning::
base-uri directive is missing
Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.
Expected: base-uri 'self'
Warning::
frame-ancestors directive is missing
frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'.
Expected: frame-ancestors 'self'
Warning::
form-action directive is missing
form-action restricts where forms can submit data, preventing form hijacking.
Expected: form-action 'self'
Info::
upgrade-insecure-requests is enabled
'unsafe-eval' allows eval() and similar functions, enabling code injection. Remove it.
Why this matters
Unsafe value (unsafe-inline, unsafe-eval) in script-src defeats CSP's main protection — XSS injections can execute again.
Learn more ▾ ▴
unsafe-inline allows inline <script> tags; unsafe-eval allows eval() and similar. Both are necessary for some legacy code but explicitly dangerous. Migrate to nonces (per-page random tokens) or hashes (per-script SHA-256) instead.
Source: OWASP CSP / MDN
Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.
Expected:
base-uri 'self'Why this matters
Missing base-uri in CSP leaves a base-tag injection attack path open even on otherwise strict policies.
Learn more ▾ ▴
A common omission: developers add CSP for script-src and frame-ancestors but forget base-uri. The result is a CSP that looks strict but lets an attacker rewrite every URL on the page via <base href>. Add `base-uri 'self'` to close the gap.
Source: MDN CSP
frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'.
Expected:
frame-ancestors 'self'Why this matters
Security gaps expose your site and users to attacks, eroding trust.
form-action restricts where forms can submit data, preventing form hijacking.
Expected:
form-action 'self'Why this matters
Security gaps expose your site and users to attacks, eroding trust.
Parsed Policy
default-src https:data:blob:'self'
upgrade-insecure-requests
script-src 'unsafe-eval'https:data:blob:'self'
style-src 'unsafe-inline''unsafe-eval'https:data:blob:'self'
img-src 'unsafe-inline''unsafe-eval'https:data:blob:'self'
BCORS ConfigurationNo CORS headersREVIEW
CORS Configuration
No CORS headers
No CORS headers
Info::
No CORS headers present — secure default
CORS Configuration ✓ Secure
No CORS headers detected.
Cross-origin requests are blocked by browser same-origin policy.
Origin reflection test
Some servers mirror the request Origin header, which can be exploited. Test manually:
curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
A+TLS & CertificatesTLS 1.3, 7 checks passedPASS
TLS & Certificates
TLS 1.3, 7 checks passed
TLS 1.3, 7 checks passed
Info::
TLS 1.3 is used
Got: TLS 1.3
Info::
Strong cipher suite is used
Got: TLS_AES_128_GCM_SHA256
Info::
HTTP/2 is not negotiated
HTTP/2 provides multiplexing and header compression for better performance.
Got: http/1.1
Info::
Certificate is valid (expires in 116 days)
Got: 2026-08-15T23:59:59Z
Info::
Certificate chain has 3 certificates
Info::
Certificate uses modern signature algorithm
Got: SHA256-RSA
Info::
Certificate covers 416 domain(s)
Got: bp.com, aral.de, castrol.com, bp.de, www.bp.de, castrolfastlane.com, b2mobility.com, b2mobility.de, www.bptankstelle.at, bptankstelle.at, bptankstelle.ch, www.bptankstelle.ch, myairbp.com, bp.pl, www.bp.pl, bpstation.ch, www.bpstation.ch, ruta56bp.com, www.bppayback.com, bppayback.com, www.bppayback.mx, www.bppayback.com.mx, bppayback.mx, bppayback.com.mx, carama.com, harimekanik.my, www.bp.co.nz, bp.co.nz, freebees.nl, poupamais-edp.pt, bpplus.com.au, jobs.bp.com, castrolfleetsavingscalc.com, castroldisplay.my, www.bpdriverrewards.com, www.bpmerewards.com, bpdriverrewards.com, bpmerewards.com, www.findcastroloil.com, castrolvic.com, bpmerewards.co.uk, talk2bp.com.au, www.talk2bp.com.au, welcome.bp.com, tuviajemasfacilbp.com, www.bp.com.tr, bp.com.tr, bppulse.co.uk, aral-pulse.de, energize.bp.com, s-enfos.bp.com, p-enfos.bp.com, www.ruta56bp.com, www.harimekanik.my, winfreefuel.bpstation.ch, www.bpskillsrefinery.com, bpskillsrefinery.com, www.castrol.co.uk, castrol.co.uk, castrol.com.cn, bpevpro.co.uk, www.bppompafiyatlari.com, bppompafiyatlari.com, enbw-bp.com, lamarderegalosbp.com, www.lamarderegalosbp.com, bpnswgovt.com.au, www.bpnswgovt.com.au, bpqldgovt.com.au, www.bpqldgovt.com.au, bpvicgovt.com.au, www.bpvicgovt.com.au, t-enfos.bp.com, entregadorcastrol.com.br, www.bp.com.au, bp.com.au, bppulse.nl, bp-pulse.nl, www.bppulse.nl, www.bp-pulse.nl, virtualdesktop.bpglobal.com, thrive.bpglobal.com, wvd.bpglobal.com, wvdadmin.bpglobal.com, actnow.bpglobal.com, ninja.bpglobal.com, mycyberscore.bpglobal.com, salesforceist.bpglobal.com, bpventures.bpglobal.com, passwordreset.bpglobal.com, selfhelp.bpglobal.com, myexpenses.bpglobal.com, techintel.bpglobal.com, cloudninja.bpglobal.com, cloudhub.bpglobal.com, modernizeit.bpglobal.com, bp360tools.bpglobal.com, ew.bpglobal.com, bpstemambassadors.bpglobal.com, dakotapro.bpglobal.com, nojvriskmanagement.bpglobal.com, myexpensestest.bpglobal.com, myexpensesuat.bpglobal.com, regscan.bpglobal.com, cloudpc.bpglobal.com, digitalbestpractices.bpglobal.com, equateplus.bpglobal.com, equateplusadmin.bpglobal.com, toolingportal.bpglobal.com, bptargetneutral.com, bptargetneutral.co.uk, bptargetneutral.at, bptargetneutral.nl, bptargetneutral.de, bptargetneutral.fr, bptargetneutral.ch, www.bptargetneutral.com, bpusspeakers.com, castrol.cn, ahorrodelocos.com, www.ahorrodelocos.com, www.entregadorcastrol.com.br, focusatbp.bpglobal.com, armontana.com, h2-fifty.com, www.bpevpro.co.uk, agilitydwp.bpglobal.com, bp.com.cn, www.temerecesmasconbp.com, myergonomics.bpglobal.com, bppulse.au, bppulse.co.nz, www.bpusimpactreport.com, bpev.co.nz, bpevcharging.co.nz, whoweare.bpglobal.com, ergonomics.bpglobal.com, www.h2teesside.co.uk, h2teesside.co.uk, www.hygreenteesside.co.uk, hygreenteesside.co.uk, findgearoil.com, healthyworking.bpglobal.com, bplaunchpad.com, stazionebp.ch, bp-oil.co.jp, www.vertelhetbp.nl, vertelhetbp.nl, bpenergy.com, www.bpplus.lt, www.bpultimate.cn, bp.jobs, airbp.ch, www.bp.co.za, www.airbp.org, www.bpcareers.jobs, www.bp-marine.com, www.guciclerinde.com, bp.energy, lingengreenhydrogen.com, lingen-green-hydrogen.com, www.lingengreenhydrogen.com, www.lingen-green-hydrogen.com, bpcharge.nz, www.bpcastrol.com, www.aral.com, www.aral-design.com, www.airbp.com, www.air-bp.com, www.bpultimate.ch, www.amoco.com, bpneighbors.com, bpultimate.co.za, castrol.com.br, www.castrol.com.br, pace.bpglobal.com, americamap.bp.com, ampm.biz, ampm.info, ampm.net, ampmcontest.com, arcoecdiesel.com, bp-austria.com, bpbiofuels.com, bpchemicals.biz, bpchemicals.co.za, bpchemicals.net, bpchemicals.org, bpcommunities.com, bpenergia.com, bpesp.com, bpeurope.com, bpfranchising.com, bpfuelplus.com, bpgasstation.com, bpgpandngl.com, bpgpngl.com, bpgreenenergy.com, bpitalia.com, bpnsi.com, bpsa.co.za, bpsmorjmedel.com, bpsolar.com, bp-solar.com, bpsolar.info, bpsolar.net, bpsolar.org, bpsolar.us, bpsolarus.com, bpturkiye.com, bpusaathletes.com, bpusaathletes.org, bpusathlete.com, bpusathlete.net, bpusathlete.org, bpusathletes.net, bpwellsville.com, bpwindenergy.us, castrol-power1.com, ftp.ecdiesel.com, ibsfuels.com, my-home.energy, test.nglnow.com, usfuelcards.bp.com, wildbean.com, www.airbp.cn, www.airbpsr.com, www.ampm.biz, www.bp.pt, www.bpa.com, www.bp-action.ch, www.bpafrica.com, www.bpamerica.com, www.bpamoco.com, www.bpasphalt.com, www.bpaustria.at, www.bp-austria.com, www.bp-azione.ch, www.bpbiofuels.com, www.bpbitumen.com, www.bpchemicals.biz, www.bpcrudes.com, www.bpdiesel.com, www.bpenergia.com, www.bpesp.com, www.bp-europa.com, www.bpfinder.co.nz, www.bp-france.com, www.bpgeorgia.ge, www.bpgpngl.com, www.bphandel.at, www.bp-jobs.com, www.bpjobs.net, www.bpkarriere.de, www.bpmarine.com, www.bpnsi.com, www.bprewards.com, www.bprewards.net, www.bprewards.org, www.bpsa.co.za, www.bpschweiz.com, www.bpsolar.com, www.bp-solar.com, www.bpsolar.info, www.bpsolar.net, www.bpsolar.org, www.bpsolar.us, www.bpsolarus.com, www.bpstiftung.de, www.bp-stiftung.de, www.bptt.com, www.bpturkiye.com, www.bpwind.com, www.btcturkey.com, www.btcturkiye.net, www.deutschebp.com, www.ecdiesel.com, www.ibsfuels.com, www.my-home.energy, www.progas.com, www.castrol.cn, aralpulse.de, surveywizard.bpglobal.com, cgweb.gasolineriabp.com.mx, redexlowcode.bpglobal.com, piamsolution-uat.bpglobal.com, myaccess.bpglobal.com, morvenoffshorewind.com, www.beaconwind.com, bprewards.co.za, www.bepear.es, aralsummer.com, bpsummer.com, earnifyrewards.com, earnify-rewards.com, earnifyreward.com, earnify-reward.com, www.aralsummer.com, www.bpsummer.com, www.ultimate102.com, www.footkhana.com, www.castroltradebarometer.com, www.castrolfootkhana.com, www.castrolfootball.com, www.bplowcarbon.com, www.bpgastation.com, www.aralkorea.kr, www.amocoultimate.com, www.alittlebettergasstation.com, ultimate102.com, pt.castrolfootball.com, myfleetsavings.com, gasstationsalittlebetter.com, footkhana.com, es.castrolfootball.com, de.castrolfootball.com, cn.castrolfootball.com, castrolfootkhana.com, castrolfootball.com, bpgastation.com, bp-polska.pl, bp-polska.com.pl, amocoultimate.com, alittlebettergasstation.com, www.wildbeancafe.com, www.teamcastrol.com, meuoleocastrol.com.br, www.aralfleetxpert.com, www.aralfleetexpert.com, www.aral-fleetexpert.de, www.aral-fleetexpert.com, api.trocadorcastrol.com.br, admin.trocadorcastrol.com.br, www.trocadorcastrol.com.br, app.trocadorcastrol.com.br, www.bplubrificantes.pt, bplubrificantes.pt, castrolfsrewards.com, www.castrolfsrewards.com, bpmerewards.com.mx, trocadorcastrol.com.br, uat.castrolfsrewards.com, www.bplubricants.com, bplubricants.com, www.bpultimate.co.uk, bpultimate.co.uk, www.bppulse.pl, www.bp-pulse.pl, areh.au, areh.com.au, australianrenewableenergyhub.com.au, australianrenewableenergyhub.com, www.areh.au, www.australianrenewableenergyhub.com.au, www.australianrenewableenergyhub.com, dev-cip.bpglobal.com, uat-cip.bpglobal.com, cip.bpglobal.com, www.bp.at, bp.nl, bpfuelcardhelp.com, www.castrol.fr, castrol.fr, bpplushelp.com, www.bpplushelp.com, help.bp.com, www.help.bp.com, bppulse.com, bepear.es, bepear.com, www.bepear.com, www.bppulse.com, bppulse.pl, bp-pulse.pl, bpme.pl, www.bpme.pl, bprewards.pl, bpmerewards.pl, www.bprewards.pl, www.bpmerewards.pl, bp-pulse.at, www.bp-pulse.at, bpakaryakit.com.tr, bpakaryakit.tr, www.bpakaryakit.com.tr, www.bpakaryakit.tr, www.bpakaryakit.com, www.bpoceanbeat.de, bpoceanbeat.de, www.bpoffshorewind.de, bpoffshorewind.de, findcaroil.com, findbikeoil.com, findgearboxoil.com, findcastroloil.com, www.findcaroil.com, www.findbikeoil.com, www.findgearboxoil.com, mybpstation.com, www.mybpstation.com, www.bp-enbw.com, bp-enbw.com, bpusimpactreport.com, bpaberdeenhydrogenhub.com, bpamerica.net, bpamerica.org, www.aral-pulse.de, www.stazionebp.ch, arcoampmfranchisingnorth.com, dcp.bpglobal.com, xconvenience.com.au, www.xconvenience.com.au, www.bppulse.co.uk, phrase.bpglobal.com, whitingnegotiations.com, www.whitingnegotiations.com
Info::
Certificate is issued by a trusted CA
Got: CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US
HTTP/2 provides multiplexing and header compression for better performance.
Why this matters
HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.
Learn more ▾ ▴
HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.
Source: MDN Web Docs
Connection
Protocol
TLS 1.3
Cipher Suite
TLS_AES_128_GCM_SHA256
HTTP Version
HTTP/1.1
Certificate Chain
Leaf Certificate
Subject CN=bp.com,O=BP P.L.C.,L=London,C=GBIssuer CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=USValid 2026-01-06T00:00:00Z → 2026-08-15T23:59:59ZExpires in 116 days SANs bp.com, aral.de, castrol.com, bp.de, www.bp.de, castrolfastlane.com, b2mobility.com, b2mobility.de, www.bptankstelle.at, bptankstelle.at, bptankstelle.ch, www.bptankstelle.ch, myairbp.com, bp.pl, www.bp.pl, bpstation.ch, www.bpstation.ch, ruta56bp.com, www.bppayback.com, bppayback.com, www.bppayback.mx, www.bppayback.com.mx, bppayback.mx, bppayback.com.mx, carama.com, harimekanik.my, www.bp.co.nz, bp.co.nz, freebees.nl, poupamais-edp.pt, bpplus.com.au, jobs.bp.com, castrolfleetsavingscalc.com, castroldisplay.my, www.bpdriverrewards.com, www.bpmerewards.com, bpdriverrewards.com, bpmerewards.com, www.findcastroloil.com, castrolvic.com, bpmerewards.co.uk, talk2bp.com.au, www.talk2bp.com.au, welcome.bp.com, tuviajemasfacilbp.com, www.bp.com.tr, bp.com.tr, bppulse.co.uk, aral-pulse.de, energize.bp.com, s-enfos.bp.com, p-enfos.bp.com, www.ruta56bp.com, www.harimekanik.my, winfreefuel.bpstation.ch, www.bpskillsrefinery.com, bpskillsrefinery.com, www.castrol.co.uk, castrol.co.uk, castrol.com.cn, bpevpro.co.uk, www.bppompafiyatlari.com, bppompafiyatlari.com, enbw-bp.com, lamarderegalosbp.com, www.lamarderegalosbp.com, bpnswgovt.com.au, www.bpnswgovt.com.au, bpqldgovt.com.au, www.bpqldgovt.com.au, bpvicgovt.com.au, www.bpvicgovt.com.au, t-enfos.bp.com, entregadorcastrol.com.br, www.bp.com.au, bp.com.au, bppulse.nl, bp-pulse.nl, www.bppulse.nl, www.bp-pulse.nl, virtualdesktop.bpglobal.com, thrive.bpglobal.com, wvd.bpglobal.com, wvdadmin.bpglobal.com, actnow.bpglobal.com, ninja.bpglobal.com, mycyberscore.bpglobal.com, salesforceist.bpglobal.com, bpventures.bpglobal.com, passwordreset.bpglobal.com, selfhelp.bpglobal.com, myexpenses.bpglobal.com, techintel.bpglobal.com, cloudninja.bpglobal.com, cloudhub.bpglobal.com, modernizeit.bpglobal.com, bp360tools.bpglobal.com, ew.bpglobal.com, bpstemambassadors.bpglobal.com, dakotapro.bpglobal.com, nojvriskmanagement.bpglobal.com, myexpensestest.bpglobal.com, myexpensesuat.bpglobal.com, regscan.bpglobal.com, cloudpc.bpglobal.com, digitalbestpractices.bpglobal.com, equateplus.bpglobal.com, equateplusadmin.bpglobal.com, toolingportal.bpglobal.com, bptargetneutral.com, bptargetneutral.co.uk, bptargetneutral.at, bptargetneutral.nl, bptargetneutral.de, bptargetneutral.fr, bptargetneutral.ch, www.bptargetneutral.com, bpusspeakers.com, castrol.cn, ahorrodelocos.com, www.ahorrodelocos.com, www.entregadorcastrol.com.br, focusatbp.bpglobal.com, armontana.com, h2-fifty.com, www.bpevpro.co.uk, agilitydwp.bpglobal.com, bp.com.cn, www.temerecesmasconbp.com, myergonomics.bpglobal.com, bppulse.au, bppulse.co.nz, www.bpusimpactreport.com, bpev.co.nz, bpevcharging.co.nz, whoweare.bpglobal.com, ergonomics.bpglobal.com, www.h2teesside.co.uk, h2teesside.co.uk, www.hygreenteesside.co.uk, hygreenteesside.co.uk, findgearoil.com, healthyworking.bpglobal.com, bplaunchpad.com, stazionebp.ch, bp-oil.co.jp, www.vertelhetbp.nl, vertelhetbp.nl, bpenergy.com, www.bpplus.lt, www.bpultimate.cn, bp.jobs, airbp.ch, www.bp.co.za, www.airbp.org, www.bpcareers.jobs, www.bp-marine.com, www.guciclerinde.com, bp.energy, lingengreenhydrogen.com, lingen-green-hydrogen.com, www.lingengreenhydrogen.com, www.lingen-green-hydrogen.com, bpcharge.nz, www.bpcastrol.com, www.aral.com, www.aral-design.com, www.airbp.com, www.air-bp.com, www.bpultimate.ch, www.amoco.com, bpneighbors.com, bpultimate.co.za, castrol.com.br, www.castrol.com.br, pace.bpglobal.com, americamap.bp.com, ampm.biz, ampm.info, ampm.net, ampmcontest.com, arcoecdiesel.com, bp-austria.com, bpbiofuels.com, bpchemicals.biz, bpchemicals.co.za, bpchemicals.net, bpchemicals.org, bpcommunities.com, bpenergia.com, bpesp.com, bpeurope.com, bpfranchising.com, bpfuelplus.com, bpgasstation.com, bpgpandngl.com, bpgpngl.com, bpgreenenergy.com, bpitalia.com, bpnsi.com, bpsa.co.za, bpsmorjmedel.com, bpsolar.com, bp-solar.com, bpsolar.info, bpsolar.net, bpsolar.org, bpsolar.us, bpsolarus.com, bpturkiye.com, bpusaathletes.com, bpusaathletes.org, bpusathlete.com, bpusathlete.net, bpusathlete.org, bpusathletes.net, bpwellsville.com, bpwindenergy.us, castrol-power1.com, ftp.ecdiesel.com, ibsfuels.com, my-home.energy, test.nglnow.com, usfuelcards.bp.com, wildbean.com, www.airbp.cn, www.airbpsr.com, www.ampm.biz, www.bp.pt, www.bpa.com, www.bp-action.ch, www.bpafrica.com, www.bpamerica.com, www.bpamoco.com, www.bpasphalt.com, www.bpaustria.at, www.bp-austria.com, www.bp-azione.ch, www.bpbiofuels.com, www.bpbitumen.com, www.bpchemicals.biz, www.bpcrudes.com, www.bpdiesel.com, www.bpenergia.com, www.bpesp.com, www.bp-europa.com, www.bpfinder.co.nz, www.bp-france.com, www.bpgeorgia.ge, www.bpgpngl.com, www.bphandel.at, www.bp-jobs.com, www.bpjobs.net, www.bpkarriere.de, www.bpmarine.com, www.bpnsi.com, www.bprewards.com, www.bprewards.net, www.bprewards.org, www.bpsa.co.za, www.bpschweiz.com, www.bpsolar.com, www.bp-solar.com, www.bpsolar.info, www.bpsolar.net, www.bpsolar.org, www.bpsolar.us, www.bpsolarus.com, www.bpstiftung.de, www.bp-stiftung.de, www.bptt.com, www.bpturkiye.com, www.bpwind.com, www.btcturkey.com, www.btcturkiye.net, www.deutschebp.com, www.ecdiesel.com, www.ibsfuels.com, www.my-home.energy, www.progas.com, www.castrol.cn, aralpulse.de, surveywizard.bpglobal.com, cgweb.gasolineriabp.com.mx, redexlowcode.bpglobal.com, piamsolution-uat.bpglobal.com, myaccess.bpglobal.com, morvenoffshorewind.com, www.beaconwind.com, bprewards.co.za, www.bepear.es, aralsummer.com, bpsummer.com, earnifyrewards.com, earnify-rewards.com, earnifyreward.com, earnify-reward.com, www.aralsummer.com, www.bpsummer.com, www.ultimate102.com, www.footkhana.com, www.castroltradebarometer.com, www.castrolfootkhana.com, www.castrolfootball.com, www.bplowcarbon.com, www.bpgastation.com, www.aralkorea.kr, www.amocoultimate.com, www.alittlebettergasstation.com, ultimate102.com, pt.castrolfootball.com, myfleetsavings.com, gasstationsalittlebetter.com, footkhana.com, es.castrolfootball.com, de.castrolfootball.com, cn.castrolfootball.com, castrolfootkhana.com, castrolfootball.com, bpgastation.com, bp-polska.pl, bp-polska.com.pl, amocoultimate.com, alittlebettergasstation.com, www.wildbeancafe.com, www.teamcastrol.com, meuoleocastrol.com.br, www.aralfleetxpert.com, www.aralfleetexpert.com, www.aral-fleetexpert.de, www.aral-fleetexpert.com, api.trocadorcastrol.com.br, admin.trocadorcastrol.com.br, www.trocadorcastrol.com.br, app.trocadorcastrol.com.br, www.bplubrificantes.pt, bplubrificantes.pt, castrolfsrewards.com, www.castrolfsrewards.com, bpmerewards.com.mx, trocadorcastrol.com.br, uat.castrolfsrewards.com, www.bplubricants.com, bplubricants.com, www.bpultimate.co.uk, bpultimate.co.uk, www.bppulse.pl, www.bp-pulse.pl, areh.au, areh.com.au, australianrenewableenergyhub.com.au, australianrenewableenergyhub.com, www.areh.au, www.australianrenewableenergyhub.com.au, www.australianrenewableenergyhub.com, dev-cip.bpglobal.com, uat-cip.bpglobal.com, cip.bpglobal.com, www.bp.at, bp.nl, bpfuelcardhelp.com, www.castrol.fr, castrol.fr, bpplushelp.com, www.bpplushelp.com, help.bp.com, www.help.bp.com, bppulse.com, bepear.es, bepear.com, www.bepear.com, www.bppulse.com, bppulse.pl, bp-pulse.pl, bpme.pl, www.bpme.pl, bprewards.pl, bpmerewards.pl, www.bprewards.pl, www.bpmerewards.pl, bp-pulse.at, www.bp-pulse.at, bpakaryakit.com.tr, bpakaryakit.tr, www.bpakaryakit.com.tr, www.bpakaryakit.tr, www.bpakaryakit.com, www.bpoceanbeat.de, bpoceanbeat.de, www.bpoffshorewind.de, bpoffshorewind.de, findcaroil.com, findbikeoil.com, findgearboxoil.com, findcastroloil.com, www.findcaroil.com, www.findbikeoil.com, www.findgearboxoil.com, mybpstation.com, www.mybpstation.com, www.bp-enbw.com, bp-enbw.com, bpusimpactreport.com, bpaberdeenhydrogenhub.com, bpamerica.net, bpamerica.org, www.aral-pulse.de, www.stazionebp.ch, arcoampmfranchisingnorth.com, dcp.bpglobal.com, xconvenience.com.au, www.xconvenience.com.au, www.bppulse.co.uk, phrase.bpglobal.com, whitingnegotiations.com, www.whitingnegotiations.comSignature SHA256-RSASerial 31d6e56f2017c3b51053c54a76f37f4
Intermediate (CA Certificate)
Subject CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=USIssuer CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=USValid 2021-03-30T00:00:00Z → 2031-03-29T23:59:59ZExpires in 1803 days Signature SHA256-RSASerial cf5bd062b5602f47ab8502c23ccf066
Intermediate (CA Certificate)
Subject CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=USIssuer CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=USValid 2013-08-01T12:00:00Z → 2038-01-15T12:00:00ZExpires in 4286 days Signature SHA256-RSASerial 33af1e6a711a9a0bb2864b11d09fae5
A+Subresource IntegrityNo external resourcesPASS
Subresource Integrity
No external resources
No external resources
Info::
No external resources to protect
SRI Coverage No external resources — SRI not applicable
A+JS Library VulnerabilitiesNo known vulnerabilitiesPASS
JS Library Vulnerabilities
No known vulnerabilities
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected
No known JavaScript library vulnerabilities detected.
A+Information LeakageNo exposuresPASS
Information Leakage
No exposures
No exposures
Info::
No security.txt found
Consider adding a security.txt at /.well-known/security.txt.
Info::
No sensitive files exposed
No sensitive files exposed — all paths returned 404.
| Path | Status | Category | Risk |
|---|---|---|---|
| /.git/HEAD | ✓ Not found | Version Control | — |
| /.git/config | ✓ Not found | Version Control | — |
| /.svn/entries | ✓ Not found | Version Control | — |
| /.env | ✓ Not found | Configuration | — |
| /.env.local | ✓ Not found | Configuration | — |
| /.env.production | ✓ Not found | Configuration | — |
| /wp-config.php | ✓ Not found | Configuration | — |
| /.htaccess | ✓ Not found | Configuration | — |
| /phpinfo.php | ✓ Not found | Debug | — |
| /server-status | ✓ Not found | Debug | — |
| /server-info | ✓ Not found | Debug | — |
| /.well-known/security.txt | ✓ Not found | Security Policy | — |
A+Email SecurityDMARC: rejectPASS
Email Security
DMARC: reject
DMARC: reject
Info::
DMARC policy is reject — strongest protection
DMARC
Policy reject — strongest protection Record v=DMARC1; p=reject; pct=100; sp=reject; rua=mailto:a0605431@inbox.ondmarc.com; ruf=mailto:a0605431@inbox.ondmarc.com; adkim=r; aspf=r; fo=1; rf=afrf; ri=3600
A+Permissions-Policy23 directives, 2 missingPASS
Permissions-Policy
23 directives, 2 missing
23 directives, 2 missing
Info::
accelerometer=() — blocked for all origins
Info::
ambient-light-sensor=() — blocked for all origins
Info::
autoplay=() — blocked for all origins
Info::
battery=() — blocked for all origins
Info::
camera=() — blocked for all origins
Info::
display-capture=() — blocked for all origins
Info::
document-domain=() — blocked for all origins
Info::
encrypted-media=() — blocked for all origins
Info::
execution-while-not-rendered=() — blocked for all origins
Info::
execution-while-out-of-viewport=() — blocked for all origins
Info::
gyroscope=() — blocked for all origins
Info::
layout-animations=() — blocked for all origins
Info::
legacy-image-formats=() — blocked for all origins
Info::
magnetometer=() — blocked for all origins
Info::
midi=() — blocked for all origins
Info::
navigation-override=() — blocked for all origins
Info::
payment=() — blocked for all origins
Info::
picture-in-picture=() — blocked for all origins
Info::
publickey-credentials-get=() — blocked for all origins
Info::
usb=() — blocked for all origins
Info::
vr=() — blocked for all origins
Info::
wake-lock=() — blocked for all origins
Info::
xr-spatial-tracking=() — blocked for all origins
Info::
microphone not restricted
Consider adding microphone=() to block microphone access from embedded content.
Info::
geolocation not restricted
Consider adding geolocation=() to block geolocation access from embedded content.
Raw Header
accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() gyroscope=() layout-animations=() legacy-image-formats=() magnetometer=() midi=() navigation-override=() payment=() picture-in-picture=() publickey-credentials-get=() usb=() vr=() wake-lock=() xr-spatial-tracking=()
Feature Permissions
Blocked Self Only Unrestricted Not Set
accelerometer Blocked
ambient-light-sensor Blocked
autoplay Blocked
battery Blocked
camera Blocked
display-capture Blocked
document-domain Blocked
encrypted-media Blocked
execution-while-not-rendered Blocked
execution-while-out-of-viewport Blocked
gyroscope Blocked
layout-animations Blocked
legacy-image-formats Blocked
magnetometer Blocked
midi Blocked
navigation-override Blocked
payment Blocked
picture-in-picture Blocked
publickey-credentials-get Blocked
usb Blocked
vr Blocked
wake-lock Blocked
xr-spatial-tracking Blocked
microphone Not Set
geolocation Not Set
ATransport SecurityHTTP/3, HSTS, and TLS version analysisPASS
Transport Security
HTTP/3, HSTS, and TLS version analysis
HTTP/3, HSTS, and TLS version analysis
Info::
HTTP/3 (QUIC) not advertised
HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.
Info::
HSTS enabled (base policy)
Info::
HSTS missing includeSubDomains
Without includeSubDomains, HSTS only protects the exact domain.
Info::
TLS 1.3 in use (fastest handshake, 1-RTT)
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.