zador.nl

Metaalbewerking Op Maat | De One-Stop-Shop in Metaalbewerking | Zador

Zador is de specialist in metaalbewerking op maat met alle bewerkingen in eigen huis. Van engineering tot eindproduct. Part of EXAPA Group. Vraag vrijblijvend een offerte aan.

Last scanned 47 min agoCompare with another site →

Built with

Backend: Laravel · PHP

Also detected

Infrastructure: Nginx
Third-party services: Google Tag Manager

Overview

Status: alive
Registered: not looked up yet
First seen here: 2026-09-22
Security grade: F (45/100, from headers & TLS)
Privacy score: 76/100 (1 third-party script hosts, 1 tracking/marketing services)
Hosting: IONOS SE · AS8560 · Germany
Server header: nginx
Response time: 325 ms to first byte, measured from our crawler
TLS certificate: Let's Encrypt · TLSv1.3 · expires 2026-10-27
Language: nl
Mobile-ready: yes (viewport meta tag)
Structured data: Organization
Linked to from: 4 other sites seen so far

Loads scripts from

Third-party domains this page pulls JavaScript or iframes from. Each one can see who visits.

google.com

What to fix

Add a Content-Security-Policy
Limits which scripts can run, and is the main defense against XSS. Start with Content-Security-Policy-Report-Only to test.
Add X-Content-Type-Options
Header: X-Content-Type-Options: nosniff
Prevent clickjacking
Header: X-Frame-Options: DENY (or a CSP frame-ancestors directive).
Add a Referrer-Policy
Header: Referrer-Policy: strict-origin-when-cross-origin
Mark cookies Secure and HttpOnly
At least one cookie is sent without these flags, exposing it to interception or scripts.
Publish a DMARC record
A TXT record at _dmarc.<domain>; start with v=DMARC1; p=none; to monitor.

Security & email signals

✓ HTTPS
✓ HSTS
✗ Content-Security-Policy
✗ X-Content-Type-Options
✗ X-Frame-Options
✗ Referrer-Policy
✗ Permissions-Policy
✓ SPF record
✗ DMARC record
✗ DKIM record
✗ Cookies set securely
✓ Has real content (not an empty shell)
✓ Valid TLS certificate

Badge

Show this site's security grade in a README or footer:

<a href="https://webtelemetry.dev/site/zador.nl"><img src="https://webtelemetry.dev/badge/zador.nl.svg" alt="Security grade"></a>

Generated automatically from passive, publicly observable data. Think something here is wrong or want this profile removed? See /bot. Machine-readable: JSON.