HTTP Security Headers
bnonline.fi.cr
bnonline.fi.cr has no A or AAAA record, so nothing answers at bnonline.fi.cr itself. These are the headers served at www.bnonline.fi.cr.
Final status: 200
https://www.bnonline.fi.cr (302)https://bncr.bnonline.fi.cr/BNCR.InternetBanking.Web (307)https://auth.bncr.fi.cr/adfs/ls?version=1.0&action=signin&realm=urn%3AAppProxy%3Acom&appRealm=37d0e840-bdc3-e911-90f3-005056b6cfbb&returnUrl=https%3A%2F%2Fbncr.bnonline.fi.cr%2FBNCR.InternetBanking.Web&client-request-id=308CF67F-7251-0003-0418-A5305172DD01 (200)
Security Headers
Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS, preventing protocol-downgrade attacks.
Content-Security-Policy (CSP) — missing
Limits where scripts/resources can load from — the strongest defense against XSS.
X-Frame-Options DENY
Blocks the site from being embedded in iframes (clickjacking protection).
X-Content-Type-Options — missing
Stops browsers from MIME-sniffing responses away from the declared type.
Referrer-Policy — missing
Controls how much referrer information is sent to other sites.
Permissions-Policy — missing
Restricts access to browser features like camera, microphone, geolocation.