Skip to content
https://chatgpt.com

Security

· 32 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.
SCORE
82
GRADE
B
FIX
5
REVIEW
2
PASS
25
INFO
0
Checks
32
25 PASS 2 REVIEW 5 FIX
F
Content Security Policy
Action
No enforcing CSP policy found
FIX
No enforcing CSP policy found
Critical::
No Content-Security-Policy header found
CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.
Expected: default-src 'self'

CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.

Expected: default-src 'self'
Why this matters

Without a CSP, a single XSS bug can exfiltrate everything users type — credentials, payment data, session tokens.

Learn more ▾

Content-Security-Policy is the browser-enforced firewall against XSS. With a strict CSP, a script injection that would otherwise steal session cookies is silently blocked. Without it, your only defense is hoping every input on every form is escaped correctly forever. Start in Report-Only mode, fix violations, then graduate to enforcing.

Source: OWASP / MDN

F
Bot Challenge Detection
Action
Scan was blocked by Cloudflare -- the rest of this report does NOT reflect the real site
FIX
Scan was blocked by Cloudflare -- the rest of this report does NOT reflect the real site
Critical::
Scan returned a Cloudflare bot-protection interstitial, not the actual page
The HTML captured by the scanner is a `Cloudflare` challenge / block page. The scanner's user-agent or IP was flagged as bot traffic and the real site content was never returned. Every other section in this report (security headers, accessibility, content, SEO, performance) was computed against the few KB of interstitial HTML rather than your actual page -- those findings are NOT meaningful for this URL. Detection signal: <title>Just a moment...</title> -- Cloudflare interactive challenge Resolution paths: (1) allow-list BeaverCheck's worker IPs at the bot-protection layer, (2) configure a relaxed challenge for known scanner user-agents, or (3) accept that the public site is unscannable from third-party tools. Note that Cloudflare's "Bot Fight Mode" and "Super Bot Fight Mode" both block the scanner by default.
Got: HTTP 403, title: Just a moment...
F
Empty Page Detection
Action
1 empty-page signal(s) detected -- page may be a placeholder or have content-rendering bugs
FIX
1 empty-page signal(s) detected -- page may be a placeholder or have content-rendering bugs
Critical::
Page body has only 77 chars of text -- likely empty / placeholder
After HTML stripping, the page body contains 77 characters of text content. Below 200 chars almost always means: (1) the page is a placeholder that was never filled in, (2) JavaScript was supposed to render content but failed, (3) the page is a redirect / interstitial / wrapper that should have a real status code other than 200, or (4) it's a legitimately small page like a single-form login (in which case this finding is a false positive that confirms 'minimal content' is intentional). Review the page in a browser. If content is missing, the most common root cause is a JS-rendering pipeline that needs prerendering or server-side rendering for crawlers / scanners to capture content.
Got: 77 chars
F
Subresource Integrity Adoption
Action
0% SRI adoption (0/1 third-party resources)
FIX
0% SRI adoption (0/1 third-party resources)
Warning::
SRI adoption: 0/1 third-party resources protected (0%)
Of 1 third-party `<script>` / `<link rel=stylesheet>` resources, 0 (0%) declare a Subresource Integrity hash via the `integrity=` attribute. SRI binds the page to the exact bytes of the third-party resource: if the CDN is compromised, attacker-modified bytes won't match the declared hash and the browser refuses to execute the resource. Missing SRI on (first 1 examples): - https://challenges.cloudflare.com/turnstile/v0/b/d2d3316b729e/api.js?onload=DraY9&render=explicit Fix: add `integrity="sha384-..."` and `crossorigin="anonymous"` attributes. Generators: srihash.org, or in-browser via `await crypto.subtle.digest('SHA-384', bytes)`. Cache-bust the resource URL when you change versions, since the integrity hash will mismatch with old cached bytes.
Got: 0% (0/1)
F
Subresource Integrity
Action
0 of 1 external resources have SRI
FIX
0 of 1 external resources have SRI
Warning::
External script from challenges.cloudflare.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://challenges.cloudflare.com/turnstile/v0/b/d2d3316b729e/api.js?onload=DraY9&render=explicit
SRI Coverage 0 / 1 of external resources have integrity hashes
TagDomainIntegrity
<script>challenges.cloudflare.com✗ Missing
B
Subdomain Inventory Exposure
1 risky subdomain name(s) in certificate SANs
REVIEW
1 risky subdomain name(s) in certificate SANs
Info::
1 risky subdomain name(s) advertised in certificate SANs
These names are publicly visible via Certificate Transparency logs (crt.sh, censys.io) -- any attacker can enumerate them in seconds. Operators are often unaware that internal/staging/admin endpoints are inadvertently advertised this way. Mitigation: use a wildcard cert that doesn't enumerate, issue per-environment certs without non-prod SANs on the prod cert, or move internal services to private DNS off the public cert.
Got: amb-staging.chatgpt.com
B
CORS Configuration
No CORS headers
REVIEW
No CORS headers
Info::
No CORS headers present — secure default
CORS Configuration ✓ Secure

No CORS headers detected.

Cross-origin requests are blocked by browser same-origin policy.

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
A
Security Headers
9 of 10 headers properly configured
PASS
9 of 10 headers properly configured
Info::
HSTS is enabled with preload
Got: max-age=31536000; includeSubDomains; preload
Info::
X-Content-Type-Options is properly configured
Got: nosniff
Info::
X-Frame-Options is properly configured
Got: SAMEORIGIN
Info::
Referrer-Policy is properly configured
Got: same-origin
Info::
Permissions-Policy is set
Got: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
Critical::
Content-Security-Policy header is missing
CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.
Expected: default-src 'self'
Info::
Cross-Origin-Opener-Policy is properly configured
Got: same-origin
Info::
Cross-Origin-Embedder-Policy is set
Got: require-corp
Info::
X-Powered-By header is not present
Info::
Server header is present without version info
Got: cloudflare
Info::
Domain is in the Chrome HSTS preload list (status: preloaded)
Got: preloaded

CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.

Expected: default-src 'self'
Why this matters

Without a CSP, a single XSS bug can exfiltrate everything your users type — including credentials.

Learn more ▾

Content-Security-Policy is the browser-enforced firewall against XSS. With a strict CSP, a script injection that would otherwise steal session cookies or rewrite the page is silently blocked. Without it, your only defense is hoping every input on every form is escaped correctly forever.

Source: OWASP / MDN

A+
TLS & Certificates
TLS 1.3, 8 checks passed
PASS
TLS 1.3, 8 checks passed
Info::
TLS 1.3 is used
Got: TLS 1.3
Info::
Strong cipher suite is used
Got: TLS_AES_128_GCM_SHA256
Info::
HTTP/2 is negotiated
Got: h2
Info::
OCSP stapling not enabled
Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server.
Info::
Certificate is valid (expires in 63 days)
Got: 2026-12-19T21:31:25Z
Info::
Certificate chain has 3 certificates
Info::
Certificate uses modern signature algorithm
Got: ECDSA-SHA256
Info::
Certificate covers 3 domain(s)
Got: chatgpt.com, amb-staging.chatgpt.com, *.amb-staging.chatgpt.com
Info::
Certificate is issued by a trusted CA
Got: CN=WE1,O=Google Trust Services,C=US

Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server.

Why this matters

Without OCSP stapling, every first-time visitor pays an extra OCSP roundtrip — and the CA learns who's visiting your site.

Learn more ▾

OCSP stapling has the server fetch its own revocation status from the CA and attach the signed response to the TLS handshake. Without it, browsers contact the CA directly: extra latency for the user and a privacy leak (the CA sees who connected). Enable ssl_stapling on (nginx) / SSLUseStapling On (Apache) / OCSPStapling = on (Caddy auto-enables).

Source: RFC 6961 / Mozilla Server-Side TLS guide

Connection
Protocol
TLS 1.3
Cipher Suite
TLS_AES_128_GCM_SHA256
HTTP Version
h2 (HTTP/2)

Certificate Chain

Leaf Certificate
Subject CN=chatgpt.comIssuer CN=WE1,O=Google Trust Services,C=USValid 2026-09-20T20:31:28Z → 2026-12-19T21:31:25ZExpires in 63 days SANs chatgpt.com, amb-staging.chatgpt.com, *.amb-staging.chatgpt.comSignature ECDSA-SHA256Serial 11cdd38dcd4881351387c4c052625fc3
Intermediate (CA Certificate)
Subject CN=WE1,O=Google Trust Services,C=USIssuer CN=GTS Root R4,O=Google Trust Services LLC,C=USValid 2023-12-13T09:00:00Z → 2029-02-20T14:00:00ZExpires in 857 days Signature ECDSA-SHA384Serial 7ff31977972c224a76155d13b6d685e3
Intermediate (CA Certificate)
Subject CN=GTS Root R4,O=Google Trust Services LLC,C=USIssuer CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BEValid 2023-11-15T03:43:21Z → 2028-01-28T00:00:42ZExpires in 467 days Signature SHA256-RSASerial 7fe530bf331343bedd821610493d8a1b
A+
Cookie Security
1 cookies analyzed, 3 checks passed
PASS
1 cookies analyzed, 3 checks passed
Info::
Cookie '__cf_bm' has the Secure flag
Info::
Cookie '__cf_bm' has the HttpOnly flag
Info::
Cookie '__cf_bm' has SameSite=None
1 cookies analyzed
NameSecureHttpOnlySameSiteSizeIssues
__cf_bm✓✓None205 B—
A
WAF / Bot Protection
Cloudflare WAF (active mitigation)
PASS
Cloudflare WAF (active mitigation)
Info::
Cloudflare WAF (active mitigation) detected
Detected via: cf-ray: a4bf956b6cdc698a-CDG; cf-mitigated: challenge
Got: Cloudflare WAF (active mitigation)
A
security.txt
Vulnerability disclosure policy
PASS
Vulnerability disclosure policy
Info::
security.txt found
Got: https://chatgpt.com/.well-known/security.txt
Warning::
security.txt: Missing required 'Expires' field (RFC 9116)
Info::
security.txt is PGP signed

security.txt

Contact: https://bugcrowd.com/openai, mailto:disclosure@openai.com
Encryption: https://cdn.openai.com/security/disclosure.asc.pub
Policy: https://openai.com/.well-known/security.txt
A+
Cross-Origin Tab Safety
No new-tab links found -- no tabnabbing surface
PASS
No new-tab links found -- no tabnabbing surface
Info::
No new-tab links present
A+
CSP Inline-Style Readiness
No inline style attributes -- strict CSP is feasible
PASS
No inline style attributes -- strict CSP is feasible
Info::
No inline style attributes detected
A+
Trusted Types (XSS Sink Hardening)
No CSP header -- Trusted Types check is N/A
PASS
No CSP header -- Trusted Types check is N/A
Info::
No CSP header found -- Trusted Types check is N/A
A+
Soft-404 Detection
HTTP status is non-2xx -- soft-404 check is N/A
PASS
HTTP status is non-2xx -- soft-404 check is N/A
Info::
HTTP status is non-2xx -- soft-404 check is N/A
A+
Geo-Restriction Detection
No geo-restriction signals detected -- scan reached the page from an allowed region
PASS
No geo-restriction signals detected -- scan reached the page from an allowed region
Info::
No geo-restriction detected
A+
Maintenance Mode Detection
No maintenance-mode signals detected -- scan reached a normal page
PASS
No maintenance-mode signals detected -- scan reached a normal page
Info::
No maintenance-mode signals detected
A+
CORS Depth
No CORS response headers -- the resource is same-origin-only by browser default
PASS
No CORS response headers -- the resource is same-origin-only by browser default
Info::
No CORS response headers -- the resource is same-origin-only by browser default
A
Permissions-Policy Granularity
90% high-risk feature coverage (9/10)
PASS
90% high-risk feature coverage (9/10)
Info::
Permissions-Policy covers 9/10 high-risk features (90%)
The Permissions-Policy header explicitly declares policies for 9/10 high-risk features. Covered: camera, microphone, geolocation, payment, usb, serial, accelerometer, gyroscope, magnetometer Not declared (default-allow): midi The non-declared features fall back to their spec-default policy (usually `self`), which means an XSS-injected or compromised iframe could request them. For features the page genuinely doesn't use, declare `feature=()` to fully close them.
Got: 90% (9/10)
A+
Referrer-Policy Strictness
Referrer-Policy is `same-origin` (strict -- Referer sent only on same-origin requests)
PASS
Referrer-Policy is `same-origin` (strict -- Referer sent only on same-origin requests)
Info::
Referrer-Policy: `same-origin` -- strict -- Referer sent only on same-origin requests
Full URL Referer header on same-origin requests; no Referer at all on cross-origin. Strong privacy posture; same-origin analytics still work.
Got: same-origin
A+
Source Map Exposure
Source-map probe didn't run on this scan
PASS
Source-map probe didn't run on this scan
Info::
Source-map probe didn't run on this scan
A+
HTML Version Disclosure
No software-version disclosures in HTML
PASS
No software-version disclosures in HTML
Info::
No software-version disclosures in HTML
A+
Open Redirect Surface
No redirect-shaped query parameters in DOM links
PASS
No redirect-shaped query parameters in DOM links
Info::
No redirect-shaped query parameters in DOM links
A+
Auth Security
Page is not a login form -- auth-security checks are N/A
PASS
Page is not a login form -- auth-security checks are N/A
Info::
Page does not appear to be a login form
A+
JS Library Vulnerabilities
No known vulnerabilities
PASS
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+
Information Leakage
No exposures
PASS
No exposures
Info::
security.txt is present — good practice
Info::
No sensitive files exposed

No sensitive files exposed — all paths returned 404.

PathStatusCategoryRisk
/.git/HEAD✓ Not foundVersion Control—
/.git/config✓ Not foundVersion Control—
/.svn/entries✓ Not foundVersion Control—
/.env✓ Not foundConfiguration—
/.env.local✓ Not foundConfiguration—
/.env.production✓ Not foundConfiguration—
/wp-config.php✓ Not foundConfiguration—
/.htaccess✓ Not foundConfiguration—
/phpinfo.php✓ Not foundDebug—
/server-status✓ Not foundDebug—
/server-info✓ Not foundDebug—
/.well-known/security.txt✗ ExposedSecurity PolicyInfo
/package.json✓ Not founddependency-manifest—
/composer.json✓ Not founddependency-manifest—
/Gemfile✓ Not founddependency-manifest—
/Gemfile.lock✓ Not founddependency-manifest—
/requirements.txt✓ Not founddependency-manifest—
/pom.xml✓ Not founddependency-manifest—
/.gitlab-ci.yml✓ Not foundci-config—
/.travis.yml✓ Not foundci-config—
A+
Email Security
DMARC: reject, SPF: -all, DKIM, BIMI
PASS
DMARC: reject, SPF: -all, DKIM, BIMI
Info::
DMARC policy is reject — strongest protection
Info::
SPF ends in -all (hard fail) — strongest setting
Info::
DKIM configured (selectors: fm2, fm3, sendgrid, scph0316, ed25519, mandrill, amazonses, everlytickey2, s2, scph1019, mlsend1, mail, selector2, mta, selector1, dkim, google, klaviyo1, key1, k1, s2048, mlsend2, s1024, intercom, k2, key2, mailgun, fm1, klaviyo2, protonmail3, zoho, pm, smtp, protonmail2, smtpapi, s1, key, mxvault, scph0817, everlytickey1, protonmail, default)
Info::
MTA-STS not configured
MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts.<domain> and a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt.
Info::
TLS-RPT not configured
TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.<domain>.
Info::
BIMI configured and DMARC enforced — logo will display
DMARC
Policy reject — strongest protection Record v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:tdfyvl0n@ag.us.dmarcian.com; ruf=mailto:tdfyvl0n@fr.us.dmarcian.com;

MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts.<domain> and a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt.

Why this matters

Without MTA-STS, inbound mail can be silently downgraded to plain SMTP by a network attacker.

Learn more ▾

MTA-STS (RFC 8461) tells sending mail servers to use TLS and to refuse delivery if TLS fails. Requires both a TXT record at _mta-sts.<domain> AND a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt. Without it, an active attacker on the network path can strip STARTTLS and read the email in plaintext.

Source: RFC 8461

TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.<domain>.

Why this matters

Without TLS-RPT, you have no visibility into inbound TLS failures — MTA-STS misconfigurations stay hidden until users complain.

Learn more ▾

TLS-RPT (RFC 8460) is the feedback channel for MTA-STS: senders post aggregate reports of TLS-handshake failures to the URI in your _smtp._tls TXT record. Without it, an MTA-STS misconfiguration silently rejects mail and you find out only when someone notices missing email.

Source: RFC 8460

A+
API Surface
No API specs or GraphQL introspection found (probed 11 candidate path(s))
PASS
No API specs or GraphQL introspection found (probed 11 candidate path(s))
Info::
No API specs or GraphQL introspection found (probed 11 path(s))
A+
Permissions-Policy
16 directives, 0 missing
PASS
16 directives, 0 missing
Info::
accelerometer=() — blocked for all origins
Info::
camera=() — blocked for all origins
Info::
clipboard-read=() — blocked for all origins
Info::
clipboard-write=() — blocked for all origins
Info::
geolocation=() — blocked for all origins
Info::
gyroscope=() — blocked for all origins
Info::
hid=() — blocked for all origins
Info::
magnetometer=() — blocked for all origins
Info::
microphone=() — blocked for all origins
Info::
payment=() — blocked for all origins
Info::
publickey-credentials-get=() — blocked for all origins
Info::
screen-wake-lock=() — blocked for all origins
Info::
serial=() — blocked for all origins
Info::
sync-xhr=() — blocked for all origins
Info::
usb=() — blocked for all origins
Info::
xr-spatial-tracking=*

Raw Header

accelerometer=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=*

Feature Permissions

Blocked Self Only Unrestricted Not Set
accelerometer Blocked
camera Blocked
clipboard-read Blocked
clipboard-write Blocked
geolocation Blocked
gyroscope Blocked
hid Blocked
magnetometer Blocked
microphone Blocked
payment Blocked
publickey-credentials-get Blocked
screen-wake-lock Blocked
serial Blocked
sync-xhr Blocked
usb Blocked
xr-spatial-tracking Unrestricted
A
Transport Security
HTTP/3, HSTS, and TLS version analysis
PASS
HTTP/3, HSTS, and TLS version analysis
Info::
HTTP/3 (QUIC) not advertised
HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.
Info::
HSTS enabled (includeSubDomains, preload)
Info::
HSTS preload enabled
Info::
TLS 1.3 in use (fastest handshake, 1-RTT)
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback