Supplement · akrause.de
Cross-check
This site makes a few promises about itself: no requests to other servers, no cookies, no trackers. The “Finding” column was measured by your own browser when the page loaded.
Without JavaScript this page measures nothing. The promises and how to check them are all in the table.
| Promise | Finding | Check it yourself |
|---|---|---|
| Every request from this page goes to its own server. No scripts, fonts or images from third parties. | Not measured without JavaScript. See “Check it yourself”. | Open the developer tools (F12; in Safari: Develop › Show Web Inspector), Network tab, reload. The Domain column shows only akrause.de. |
| No analytics or tracking services. | Not measured without JavaScript. See “Check it yourself”. | Type typeof gtag or window.dataLayer in the console. Both return undefined. |
| No cookies. | Not measured without JavaScript. See “Check it yourself”. | curl -sI https://akrause.de/ | grep -i set-cookie prints nothing. In the browser: Application or Storage tab, Cookies. |
The site stores at most two settings in your browser: language (lang) and light/dark (theme), and only once you switch or open the English version. | Not measured without JavaScript. See “Check it yourself”. | Application tab (Chrome) or Storage tab (Firefox, Safari), Local Storage and Session Storage. |
| The typeface (Hanken Grotesk) is served from this site, not from Google Fonts or any other service. | Not measured without JavaScript. See “Check it yourself”. | Network tab, filter Font: only .woff2 files from akrause.de. |
| Encrypted connections only (HTTPS). | Not measured without JavaScript. See “Check it yourself”. | curl -sI http://akrause.de/ answers with a redirect to https://. The Network tab shows the protocol version in its Protocol column. |
| The browser runs only scripts and styles from this site's files. Code injected into the HTML does not run. | Not measured without JavaScript. See “Check it yourself”. | The cross-check tries to insert a script without a file and an inline style. The console reports one Content Security Policy violation for each. |
The only service worker is the site's own (/sw.js). It keeps a copy of the site for offline use. | Not measured without JavaScript. See “Check it yourself”. | Application tab, Service Workers and Cache Storage (in Safari: Develop › Service Workers). The cache is named akrause-v…. |
| Security issues can be reported via /.well-known/security.txt (RFC 9116). | Not measured without JavaScript. See “Check it yourself”. | Open the file in the browser or run curl -s https://akrause.de/.well-known/security.txt. The Expires field lies in the future, and Policy points to the section Reporting a vulnerability. |
Security headers
With every page the server sends instructions to the browser. Your browser has just fetched this page again and read the headers.
| Promise | Finding | Check it yourself |
|---|---|---|
Content-Security-PolicyEverything comes from the site's own origin, nothing inline.Expected: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' | Not measured without JavaScript. See “Check it yourself”. | curl -sI https://akrause.de/gegenprobe.html | grep -i content-security-policy, or select the document in the Network tab, Response Headers. |
Strict-Transport-SecurityFor one year your browser connects over HTTPS only.Expected: max-age=31536000; includeSubDomains; preload | Not measured without JavaScript. See “Check it yourself”. | curl -sI https://akrause.de/gegenprobe.html | grep -i strict-transport, or select the document in the Network tab, Response Headers. |
X-Frame-OptionsNo other site may embed this page.Expected: DENY | Not measured without JavaScript. See “Check it yourself”. | curl -sI https://akrause.de/gegenprobe.html | grep -i x-frame, or select the document in the Network tab, Response Headers. |
Referrer-PolicyFollowing a link to another site passes on only the domain, not the address of the page.Expected: strict-origin-when-cross-origin | Not measured without JavaScript. See “Check it yourself”. | curl -sI https://akrause.de/gegenprobe.html | grep -i referrer-policy, or select the document in the Network tab, Response Headers. |
Permissions-PolicyCamera, microphone, location, payments and USB are switched off for this site.Expected: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=() | Not measured without JavaScript. See “Check it yourself”. | curl -sI https://akrause.de/gegenprobe.html | grep -i permissions-policy, or select the document in the Network tab, Response Headers. |
X-Content-Type-OptionsThe browser does not guess file types.Expected: nosniff | Not measured without JavaScript. See “Check it yourself”. | curl -sI https://akrause.de/gegenprobe.html | grep -i x-content-type, or select the document in the Network tab, Response Headers. |
What your browser cannot see
The measurement stops at the edge of your browser. It cannot show what happens to a request on the server. The configuration of this site’s web server writes no access logs (access_log off), so neither IP address nor requested address is recorded. However, a reverse proxy in front of it logs every request with the IP address to protect against attacks. These logs are deleted after seven days. The browser cannot check that. The privacy policy has the details under “Hosting”.
Nor does the measurement see what happens to an email you send me, or whether the server delivers the same files to other visitors. Extensions in your browser can make requests of their own, and those are counted here. The cross-check covers this one page view in this browser.
Reporting a vulnerability
If you find a security vulnerability on this website, write to me at contact@akrause.de, in German or English. What helps most is the affected address and a short description of how to reproduce the problem. I typically respond within 24 hours. There is no bug bounty programme.
The same address is listed in machine-readable form in /.well-known/security.txt.
That is how I write security concepts too: as promises that can be measured.