Security
· 32 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.FSubresource Integrity AdoptionAction0% SRI adoption (0/2 third-party resources)FIX
FSubresource IntegrityAction0 of 2 external resources have SRIFIX
| Tag | Domain | Integrity |
|---|---|---|
| <link> | abs.twimg.com | ✗ Missing |
| <script> | abs.twimg.com | ✗ Missing |
DPermissions-PolicyActionNo header setFIX
No Permissions-Policy header set.
Without this header, embedded iframes can request access to sensitive device features.
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
BSecurity Headers7 of 10 headers properly configuredREVIEW
Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.
geolocation=(), camera=(), microphone=()Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.
Learn more ▾ ▴
By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.
Source: MDN / W3C
COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
require-corpCOEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.
Learn more ▾ ▴
Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.
Source: MDN / web.dev
same-originCOOP is set to a less-restrictive value (same-origin-allow-popups or unsafe-none) — partial isolation only.
Learn more ▾ ▴
COOP: same-origin is the strictest level. same-origin-allow-popups allows authenticated popup windows back to your origin. unsafe-none is the legacy default (effectively off). Pick the strictest level your app's popup flows tolerate.
Source: MDN COOP
Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload).
Not in the Chrome preload list — first-time visitors over plain HTTP can be downgraded by a network attacker before HSTS kicks in.
Learn more ▾ ▴
The HSTS header only protects users who have already visited the site (TOFU window). Adding your domain to the Chrome preload list closes that gap so HSTS is enforced from the very first connection. Requires a preload-ready header (max-age=31536000+, includeSubDomains, preload) then submission at hstspreload.org. Inclusion ships in the next Chrome release after acceptance.
Source: hstspreload.org
BContent Security Policy8 of 10 CSP checks passedREVIEW
'unsafe-inline' allows inline <script> tags, defeating CSP against XSS. Remove it and use nonces or hashes instead.
Unsafe value (unsafe-inline, unsafe-eval) in script-src defeats CSP's main protection — XSS injections can execute again.
Learn more ▾ ▴
unsafe-inline allows inline <script> tags; unsafe-eval allows eval() and similar. Both are necessary for some legacy code but explicitly dangerous. Migrate to nonces (per-page random tokens) or hashes (per-script SHA-256) instead.
Source: OWASP CSP / MDN
Parsed Policy
Bsecurity.txtVulnerability disclosure policyREVIEW
security.txt
BTrusted Types (XSS Sink Hardening)Trusted Types not enabledREVIEW
CPermissions-Policy GranularityActionNo Permissions-Policy header set -- powerful features (camera / microphone / geolocation / payment / USB) default to allow-on-same-originREVIEW
BCORS ConfigurationNo CORS headersREVIEW
No CORS headers detected.
Cross-origin requests are blocked by browser same-origin policy.
Origin reflection test
Some servers mirror the request Origin header, which can be exploited. Test manually:
curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
ATLS & CertificatesTLS 1.3, 7 checks passedPASS
Renew the certificate before it expires to avoid browser warnings.
Cert expiry within the renewal window — fix now while there's no user impact, instead of after expiry when there's a full outage.
Learn more ▾ ▴
Most CAs recommend renewal at 30 days remaining. Inside that window, schedule the renewal immediately and verify auto-renewal is configured if applicable. Don't wait until 7 days; weekend / holiday timing can leave you exposed.
Source: Let's Encrypt / CA renewal best practice
HTTP/2 provides multiplexing and header compression for better performance.
HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.
Learn more ▾ ▴
HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.
Source: MDN Web Docs
Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server.
Without OCSP stapling, every first-time visitor pays an extra OCSP roundtrip — and the CA learns who's visiting your site.
Learn more ▾ ▴
OCSP stapling has the server fetch its own revocation status from the CA and attach the signed response to the TLS handshake. Without it, browsers contact the CA directly: extra latency for the user and a privacy leak (the CA sees who connected). Enable ssl_stapling on (nginx) / SSLUseStapling On (Apache) / OCSPStapling = on (Caddy auto-enables).
Source: RFC 6961 / Mozilla Server-Side TLS guide
Certificate Chain
AWAF / Bot ProtectionCloudflarePASS
A+Cross-Origin Tab SafetyAll 16 new-tab link(s) carry rel=noopenerPASS
A+CSP Inline-Style ReadinessNo inline style attributes -- strict CSP is feasiblePASS
A+Bot Challenge DetectionScan reached real page content (no bot-protection interstitial)PASS
A+Soft-404 DetectionNo soft-404 patterns detected in page title or headingsPASS
A+Empty Page DetectionPage has substantive body text and no placeholder / template-leak signalsPASS
A+Geo-Restriction DetectionNo geo-restriction signals detected -- scan reached the page from an allowed regionPASS
A+Maintenance Mode DetectionNo maintenance-mode signals detected -- scan reached a normal pagePASS
A+CORS DepthNo CORS response headers -- the resource is same-origin-only by browser defaultPASS
A+Referrer-Policy StrictnessReferrer-Policy is `strict-origin-when-cross-origin` (modern default -- full URL same-origin, origin-only cross-origin)PASS
A+Source Map ExposureSource-map probe didn't run on this scanPASS
A+HTML Version DisclosureNo software-version disclosures in HTMLPASS
A+Open Redirect SurfaceNo redirect-shaped query parameters in DOM linksPASS
A+Auth SecurityPage is not a login form -- auth-security checks are N/APASS
A+Subdomain Inventory ExposureNo risky subdomain names in certificate SANsPASS
A+JS Library VulnerabilitiesNo known vulnerabilitiesPASS
No known JavaScript library vulnerabilities detected.
A+Information LeakageNo exposuresPASS
No sensitive files exposed — all paths returned 404.
| Path | Status | Category | Risk |
|---|---|---|---|
| /.git/HEAD | ✓ Not found | Version Control | — |
| /.git/config | ✓ Not found | Version Control | — |
| /.svn/entries | ✓ Not found | Version Control | — |
| /.env | ✓ Not found | Configuration | — |
| /.env.local | ✓ Not found | Configuration | — |
| /.env.production | ✓ Not found | Configuration | — |
| /wp-config.php | ✓ Not found | Configuration | — |
| /.htaccess | ✓ Not found | Configuration | — |
| /phpinfo.php | ✓ Not found | Debug | — |
| /server-status | ✓ Not found | Debug | — |
| /server-info | ✓ Not found | Debug | — |
| /.well-known/security.txt | ✗ Exposed | Security Policy | Info |
| /package.json | ✓ Not found | dependency-manifest | — |
| /composer.json | ✓ Not found | dependency-manifest | — |
| /Gemfile | ✓ Not found | dependency-manifest | — |
| /Gemfile.lock | ✓ Not found | dependency-manifest | — |
| /requirements.txt | ✓ Not found | dependency-manifest | — |
| /pom.xml | ✓ Not found | dependency-manifest | — |
| /.gitlab-ci.yml | ✓ Not found | ci-config | — |
| /.travis.yml | ✓ Not found | ci-config | — |
A+Email SecurityDMARC: reject, SPF: -all, DKIM, BIMIPASS
MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts.<domain> and a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt.
Without MTA-STS, inbound mail can be silently downgraded to plain SMTP by a network attacker.
Learn more ▾ ▴
MTA-STS (RFC 8461) tells sending mail servers to use TLS and to refuse delivery if TLS fails. Requires both a TXT record at _mta-sts.<domain> AND a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt. Without it, an active attacker on the network path can strip STARTTLS and read the email in plaintext.
Source: RFC 8461
TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.<domain>.
Without TLS-RPT, you have no visibility into inbound TLS failures — MTA-STS misconfigurations stay hidden until users complain.
Learn more ▾ ▴
TLS-RPT (RFC 8460) is the feedback channel for MTA-STS: senders post aggregate reports of TLS-handshake failures to the URI in your _smtp._tls TXT record. Without it, an MTA-STS misconfiguration silently rejects mail and you find out only when someone notices missing email.
Source: RFC 8460