Skip to content
https://liu.se

Security

· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.
SCORE
79
GRADE
C
FIX
2
REVIEW
3
PASS
7
INFO
0
Checks
12
7 PASS 3 REVIEW 2 FIX
F
Subresource Integrity
Action
0 of 1 external resources have SRI
FIX
0 of 1 external resources have SRI
Warning::
External script from webstatistics.liu.se lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://webstatistics.liu.se/js/script.js
SRI Coverage 0 / 1 of external resources have integrity hashes
TagDomainIntegrity
<script>webstatistics.liu.se✗ Missing
D
Permissions-Policy
Action
No header set
FIX
No header set
Warning::
No Permissions-Policy header
Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.

No Permissions-Policy header set.

Without this header, embedded iframes can request access to sensitive device features.

Suggested header
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
B
Security Headers
6 of 10 headers properly configured
REVIEW
6 of 10 headers properly configured
Warning::
HSTS is missing includeSubDomains
Without includeSubDomains, subdomains can still be accessed over HTTP.
Got: max-age=31536000; preload Expected: max-age=31536000; includeSubDomains
Info::
X-Content-Type-Options is properly configured
Got: nosniff
Info::
X-Frame-Options is properly configured
Got: SAMEORIGIN
Info::
Referrer-Policy is properly configured
Got: strict-origin-when-cross-origin
Warning::
Permissions-Policy header is missing
Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.
Expected: geolocation=(), camera=(), microphone=()
Info::
Content-Security-Policy is present
Got: default-src 'none'; img-src 'self' https://*.inviewer.se https://*.mediaflowpro.…
Warning::
Cross-Origin-Opener-Policy header is missing
COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.
Expected: same-origin
Warning::
Cross-Origin-Embedder-Policy header is missing
COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
Expected: require-corp
Info::
X-Powered-By header is not present
Info::
Server header is present without version info
Got: Apache

Without includeSubDomains, subdomains can still be accessed over HTTP.

Expected: max-age=31536000; includeSubDomains
Why this matters

Without includeSubDomains, a forgotten dev subdomain over HTTP can set malicious cookies that ride to the apex.

Learn more ▾

HSTS without includeSubDomains protects only the exact domain. Cookies set on a non-HSTS subdomain can ride to the apex via cookie-scope attacks. The fix is one directive append. Verify all subdomains support HTTPS first — adding includeSubDomains to a domain with HTTP-only subdomains breaks them.

Source: RFC 6797

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()
Why this matters

Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.

Learn more ▾

By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.

Source: MDN / W3C

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin
Why this matters

COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.

Learn more ▾

Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.

Source: MDN / web.dev

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp
Why this matters

COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.

Learn more ▾

Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.

Source: MDN / web.dev

C
CORS Configuration
Action
Origin: *
REVIEW
Origin: *
Info::
Access-Control-Allow-Origin: * — unrestricted
Any website can read this resource's response. Appropriate for public APIs but not for user-specific content.
Info::
Origin reflection not testable with a single request
Some servers reflect the request Origin header. This requires manual testing with a crafted Origin header.
CORS Configuration Permissive
Allow-Origin *

Any website can read responses from this resource.

HeaderValueStatus
Access-Control-Allow-Origin*⚠

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
B
security.txt
Published with 1 contact(s)
REVIEW

security.txt

Contact: mailto:infosec@liu.se
Expires: 2027-02-01T11:00:00.000Z
Policy: https://liu.se/security.txt
A+
Content Security Policy
8 of 10 CSP checks passed
PASS
8 of 10 CSP checks passed
Info::
Raw CSP policy
Got: default-src 'none'; img-src 'self' https://*.inviewer.se https://*.mediaflowpro.com https://static.liu.se https://kundo.se https://static.kundo.se https://chat.kundo.se data: https://admin.media.liu.se https://post-image.getflowbox.com https://storage.gra.cloud.ovh.net https://www.liu.se https://liu.diva-portal.org https://www2.bibl.liu.se https://i.ytimg.com https://pbs.twimg.com https://ton.twimg.com https://platform.twitter.com https://syndication.twitter.com https://d2rfa446ja7yzb.cloudfront.net; connect-src 'self' https://*.mediaflowpro.com https://*.mediaflow.com https://mfstatic.com https://org-1808.chat.kundo.se https://chat.kundo.se https://sentry.kundo.se wss://ws-eu.pusher.com https://*.pusher.com https://kundo.se https://static.kundo.se wss://ebbot.eu https://ebbot.eu https://storage.gra.cloud.ovh.net https://search.liu.se https://webstat.liu.se https://webstatistics.liu.se https://plausible.it.liu.se https://www2.bibl.liu.se https://chat-eu.libanswers.com https://vod-progressive.akamaized.net https://cicptqmkej.execute-api.eu-west-1.amazonaws.com https://9mn3sm7015.execute-api.eu-west-1.amazonaws.com https://a.getflowbox.com https://gateway.getflowbox.com https://powerva.microsoft.com https://75ef70113386e45c814f199b22604d.53.environment.api.powerplatform.com https://54bd0db7f610ef1ab766eb3adc3e4e.4d.environment.api.powerplatform.com wss://54bd0db7f610ef1ab766eb3adc3e4e.4d.environment.api.powerplatform.com https://directline.botframework.com wss://directline.botframework.com; frame-ancestors 'self' ; script-src 'self' https://mfstatic.com https://static-chat.kundo.se https://chat.kundo.se https://storage.gra.cloud.ovh.net https://www.liu.se https://webstat.liu.se https://webstatistics.liu.se https://plausible.it.liu.se https://www2.bibl.liu.se https://liu-se.libanswers.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.google.com https://www.gstatic.com https://connect.getflowbox.com https://gateway.getflowbox.com https://www.youtube.com https://cdn.botframework.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://mfstatic.com https://static-chat.kundo.se https://chat.kundo.se https://storage.gra.cloud.ovh.net https://www.liu.se https://www2.bibl.liu.se https://platform.twitter.com; frame-src 'self' https://*.mediaflow.com https://org-1808.chat.kundo.se https://chat.kundo.se https://sentry.kundo.se https://www2.bibl.liu.se https://api.screen9.com https://liu-se.libanswers.com https://admin.media.liu.se https://*.vimeocdn.com https://vimeo.com https://player.vimeo.com https://embed.ur.se https://www.youtube.com https://www.podbean.com https://platform.twitter.com https://syndication.twitter.com https://www.google.com; form-action 'self' https://search.liu.se https://marketing.studentrecruitment.liu.se *.ebscohost.com publications.ebsco.com libris.kb.se *.diva-portal.org search.scifree.se; font-src 'self' https://mfstatic.com https://storage.gra.cloud.ovh.net; media-src 'self' blob: https://*.mediaflow.com https://damcdn.media.liu.se https://admin.media.liu.se https://player.vimeo.com https://*.vimeocdn.com https://*.akamaized.net https://cdn.flbx.io; base-uri 'none'
Info::
default-src directive is set
Got: default-src 'none'
Info::
No 'unsafe-inline' in script source
Info::
No 'unsafe-eval' in script source
Info::
No wildcard in script source
Info::
object-src falls back to default-src
Info::
base-uri is properly restricted
Got: base-uri 'none'
Info::
frame-ancestors directive is set
Got: frame-ancestors 'self'
Info::
form-action directive is set
Got: form-action 'self' https://search.liu.se https://marketing.studentrecruitment.liu.se *.ebscohost.com publications.ebsco.com libris.kb.se *.diva-portal.org search.scifree.se
Info::
upgrade-insecure-requests is not set
This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.
Expected: upgrade-insecure-requests

This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.

Expected: upgrade-insecure-requests
Why this matters

Without upgrade-insecure-requests, any HTTP subresource link survives as a mixed-content warning instead of auto-upgrading.

Learn more ▾

Adding `upgrade-insecure-requests` to your CSP turns every http:// subresource fetch into https:// at the browser layer. One-line defense against accidental mixed content from legacy links or third-party widgets.

Source: MDN CSP

Parsed Policy

default-src 'none'
img-src 'self'https://*.inviewer.sehttps://*.mediaflowpro.comhttps://static.liu.sehttps://kundo.sehttps://static.kundo.sehttps://chat.kundo.sedata:https://admin.media.liu.sehttps://post-image.getflowbox.comhttps://storage.gra.cloud.ovh.nethttps://www.liu.sehttps://liu.diva-portal.orghttps://www2.bibl.liu.sehttps://i.ytimg.comhttps://pbs.twimg.comhttps://ton.twimg.comhttps://platform.twitter.comhttps://syndication.twitter.comhttps://d2rfa446ja7yzb.cloudfront.net
connect-src 'self'https://*.mediaflowpro.comhttps://*.mediaflow.comhttps://mfstatic.comhttps://org-1808.chat.kundo.sehttps://chat.kundo.sehttps://sentry.kundo.sewss://ws-eu.pusher.comhttps://*.pusher.comhttps://kundo.sehttps://static.kundo.sewss://ebbot.euhttps://ebbot.euhttps://storage.gra.cloud.ovh.nethttps://search.liu.sehttps://webstat.liu.sehttps://webstatistics.liu.sehttps://plausible.it.liu.sehttps://www2.bibl.liu.sehttps://chat-eu.libanswers.comhttps://vod-progressive.akamaized.nethttps://cicptqmkej.execute-api.eu-west-1.amazonaws.comhttps://9mn3sm7015.execute-api.eu-west-1.amazonaws.comhttps://a.getflowbox.comhttps://gateway.getflowbox.comhttps://powerva.microsoft.comhttps://75ef70113386e45c814f199b22604d.53.environment.api.powerplatform.comhttps://54bd0db7f610ef1ab766eb3adc3e4e.4d.environment.api.powerplatform.comwss://54bd0db7f610ef1ab766eb3adc3e4e.4d.environment.api.powerplatform.comhttps://directline.botframework.comwss://directline.botframework.com
frame-ancestors 'self'
script-src 'self'https://mfstatic.comhttps://static-chat.kundo.sehttps://chat.kundo.sehttps://storage.gra.cloud.ovh.nethttps://www.liu.sehttps://webstat.liu.sehttps://webstatistics.liu.sehttps://plausible.it.liu.sehttps://www2.bibl.liu.sehttps://liu-se.libanswers.comhttps://platform.twitter.comhttps://cdn.syndication.twimg.comhttps://www.google.comhttps://www.gstatic.comhttps://connect.getflowbox.comhttps://gateway.getflowbox.comhttps://www.youtube.comhttps://cdn.botframework.comhttps://cdnjs.cloudflare.com
style-src 'self''unsafe-inline'https://mfstatic.comhttps://static-chat.kundo.sehttps://chat.kundo.sehttps://storage.gra.cloud.ovh.nethttps://www.liu.sehttps://www2.bibl.liu.sehttps://platform.twitter.com
frame-src 'self'https://*.mediaflow.comhttps://org-1808.chat.kundo.sehttps://chat.kundo.sehttps://sentry.kundo.sehttps://www2.bibl.liu.sehttps://api.screen9.comhttps://liu-se.libanswers.comhttps://admin.media.liu.sehttps://*.vimeocdn.comhttps://vimeo.comhttps://player.vimeo.comhttps://embed.ur.sehttps://www.youtube.comhttps://www.podbean.comhttps://platform.twitter.comhttps://syndication.twitter.comhttps://www.google.com
form-action 'self'https://search.liu.sehttps://marketing.studentrecruitment.liu.se*.ebscohost.compublications.ebsco.comlibris.kb.se*.diva-portal.orgsearch.scifree.se
font-src 'self'https://mfstatic.comhttps://storage.gra.cloud.ovh.net
media-src 'self'blob:https://*.mediaflow.comhttps://damcdn.media.liu.sehttps://admin.media.liu.sehttps://player.vimeo.comhttps://*.vimeocdn.comhttps://*.akamaized.nethttps://cdn.flbx.io
base-uri 'none'
A+
TLS & Certificates
TLS 1.3, 7 checks passed
PASS
TLS 1.3, 7 checks passed
Info::
TLS 1.3 is used
Got: TLS 1.3
Info::
Strong cipher suite is used
Got: TLS_AES_256_GCM_SHA384
Info::
HTTP/2 is not negotiated
HTTP/2 provides multiplexing and header compression for better performance.
Got: http/1.1
Info::
Certificate is valid (expires in 53 days)
Got: 2026-06-14T00:16:25Z
Info::
Certificate chain has 2 certificates
Info::
Certificate uses modern signature algorithm
Got: SHA256-RSA
Info::
Certificate covers 2 domain(s)
Got: liu.se, www.liu.se
Info::
Certificate is issued by a trusted CA
Got: CN=R13,O=Let's Encrypt,C=US

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection
Protocol
TLS 1.3
Cipher Suite
TLS_AES_256_GCM_SHA384
HTTP Version
HTTP/1.1

Certificate Chain

Leaf Certificate
Subject CN=liu.seIssuer CN=R13,O=Let's Encrypt,C=USValid 2026-03-16T00:16:26Z → 2026-06-14T00:16:25ZExpires in 53 days SANs liu.se, www.liu.seSignature SHA256-RSASerial 6c3dd691d602483ee792d604e54338df009
Intermediate (CA Certificate)
Subject CN=R13,O=Let's Encrypt,C=USIssuer CN=ISRG Root X1,O=Internet Security Research Group,C=USValid 2024-03-13T00:00:00Z → 2027-03-12T23:59:59ZExpires in 325 days Signature SHA256-RSASerial 5a00f212d8d4b480f3924157ea298305
A
Cookie Security
2 cookies analyzed, 4 checks passed
PASS
2 cookies analyzed, 4 checks passed
Info::
Cookie 'liu#lang' has the Secure flag
Warning::
Cookie 'liu#lang' is missing the HttpOnly flag
Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.
Info::
Cookie 'liu#lang' has SameSite=None
Info::
Cookie 'shell#lang' has the Secure flag
Warning::
Cookie 'shell#lang' is missing the HttpOnly flag
Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.
Info::
Cookie 'shell#lang' has SameSite=None
2 cookies analyzed 2 warnings
NameSecureHttpOnlySameSiteSizeIssues
liu#lang✓✗None13 B1
shell#lang✓✗None12 B1
A+
JS Library Vulnerabilities
No known vulnerabilities
PASS
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+
Information Leakage
No exposures
PASS
No exposures
Info::
No security.txt found
Consider adding a security.txt at /.well-known/security.txt.
Info::
No sensitive files exposed

No sensitive files exposed — all paths returned 404.

PathStatusCategoryRisk
/.git/HEAD✓ Not foundVersion Control—
/.git/config✓ Not foundVersion Control—
/.svn/entries✓ Not foundVersion Control—
/.env✓ Not foundConfiguration—
/.env.local✓ Not foundConfiguration—
/.env.production✓ Not foundConfiguration—
/wp-config.php✓ Not foundConfiguration—
/.htaccess✓ Not foundConfiguration—
/phpinfo.php✓ Not foundDebug—
/server-status✓ Not foundDebug—
/server-info✓ Not foundDebug—
/.well-known/security.txt✓ Not foundSecurity Policy—
A+
Email Security
DMARC: reject
PASS
DMARC: reject
Info::
DMARC policy is reject — strongest protection
DMARC
Policy reject — strongest protection Record v=DMARC1; p=reject; rua=mailto:re+mqtv8v3e6x7@dmarc.postmarkapp.com; ruf=mailto:dmarc@it.liu.se; sp=none; aspf=r;
A
Transport Security
HTTP/3, HSTS, and TLS version analysis
PASS
HTTP/3, HSTS, and TLS version analysis
Info::
HTTP/3 (QUIC) not advertised
HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.
Info::
HSTS enabled (preload)
Info::
HSTS missing includeSubDomains
Without includeSubDomains, HSTS only protects the exact domain.
Info::
HSTS preload enabled
Info::
TLS 1.3 in use (fastest handshake, 1-RTT)
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback