Skip to content
https://entrepreneur.com

Security

· 13 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.
SCORE
70
GRADE
C
FIX
5
REVIEW
3
PASS
5
INFO
0
Checks
13
5 PASS 3 REVIEW 5 FIX
D
Security Headers
Action
4 of 10 headers properly configured
FIX
4 of 10 headers properly configured
Warning::
HSTS is missing includeSubDomains
Without includeSubDomains, subdomains can still be accessed over HTTP.
Got: max-age=31557600 Expected: max-age=31536000; includeSubDomains
Info::
X-Content-Type-Options is properly configured
Got: nosniff
Warning::
X-Frame-Options header is missing
This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN.
Expected: DENY
Warning::
Referrer-Policy header is missing
Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.
Expected: strict-origin-when-cross-origin
Warning::
Permissions-Policy header is missing
Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.
Expected: geolocation=(), camera=(), microphone=()
Info::
Content-Security-Policy is present
Got: frame-ancestors 'self'
Warning::
Cross-Origin-Opener-Policy header is missing
COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.
Expected: same-origin
Warning::
Cross-Origin-Embedder-Policy header is missing
COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
Expected: require-corp
Info::
X-Powered-By header is not present
Info::
Server header is present without version info
Got: Varnish

Without includeSubDomains, subdomains can still be accessed over HTTP.

Expected: max-age=31536000; includeSubDomains
Why this matters

Without includeSubDomains, a forgotten dev subdomain over HTTP can set malicious cookies that ride to the apex.

Learn more ▾

HSTS without includeSubDomains protects only the exact domain. Cookies set on a non-HSTS subdomain can ride to the apex via cookie-scope attacks. The fix is one directive append. Verify all subdomains support HTTPS first — adding includeSubDomains to a domain with HTTP-only subdomains breaks them.

Source: RFC 6797

This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN.

Expected: DENY
Why this matters

Without frame protection, your site can be embedded in a hostile page and used for clickjacking.

Learn more ▾

Clickjacking overlays your site under a transparent malicious page so users click invisible buttons. Setting X-Frame-Options: DENY (or a modern frame-ancestors CSP directive) blocks the embedding entirely. There's almost never a legitimate reason to allow it.

Source: OWASP / MDN

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin
Why this matters

Default browser behavior leaks full URLs (including query params and tokens) to every third-party resource — set a strict policy.

Learn more ▾

Without a Referrer-Policy header, browsers send the full referring URL with images, scripts, and fonts loaded from third-party origins. URLs containing tokens, user IDs, or session params end up in third-party logs. Set `Referrer-Policy: strict-origin-when-cross-origin` (or stricter) to limit leakage.

Source: MDN / W3C

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()
Why this matters

Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.

Learn more ▾

By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.

Source: MDN / W3C

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin
Why this matters

COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.

Learn more ▾

Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.

Source: MDN / web.dev

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp
Why this matters

COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.

Learn more ▾

Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.

Source: MDN / web.dev

D
Cookie Security
Action
2 cookies analyzed, 0 checks passed
FIX
2 cookies analyzed, 0 checks passed
Critical::
Cookie 'language' is missing the Secure flag
Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.
Warning::
Cookie 'language' is missing the HttpOnly flag
Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.
Warning::
Cookie 'language' has no SameSite attribute
Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.
Critical::
Cookie 'geo' is missing the Secure flag
Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.
Warning::
Cookie 'geo' is missing the HttpOnly flag
Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.
Warning::
Cookie 'geo' has no SameSite attribute
Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.
2 cookies analyzed 2 critical 4 warnings
NameSecureHttpOnlySameSiteSizeIssues
language✗✗—10 B3
geo✗✗—169 B3
F
Subresource Integrity
Action
0 of 66 external resources have SRI
FIX
0 of 66 external resources have SRI
Warning::
External script from auth.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://auth.entrepreneur.com/id/api/v1/identity/token/verify?browser_id=mo8zx0bqu0r2lzrh&page_view_id=mo8zx0bqyze4dzug&content_type=website&page_title=Homepage&callback=jsonp9044&client_id=3CgcRbFCpu&site=https%3A%2F%2Fwww.entrepreneur.com&tcf=CQjA2wAQjA2wAEXpEBENBaEgAAAAAEPgAAiQAAALzgCAAVAD8ARYBeYAAAAA&user_state=anon
Warning::
External script from api-esp.piano.io lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://api-esp.piano.io/public/sdk/vx/sdk.js?v=xxx&i=65BDB153-CFE3-4F42-8F1C-8464C721F5FF
Warning::
External script from cdn.tinypass.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.tinypass.com/api/tinypass.min.js
Warning::
External script from js.hubspot.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://js.hubspot.com/web-interactives-embed.js
Warning::
External script from js.hscollectedforms.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://js.hscollectedforms.net/collectedforms.js
Warning::
External script from js.hsadspixel.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://js.hsadspixel.net/pixels.js
Warning::
External script from js.usemessages.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://js.usemessages.com/conversations-embed.js
Warning::
External script from js.hs-banner.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://js.hs-banner.com/v2/21266006/banner.js
Warning::
External script from experiments.parsely.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://experiments.parsely.com/vip-experiments.js?apiKey=entrepreneur.com
Warning::
External script from cmp.osano.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cmp.osano.com/AzqBmEUU91e314HKV/9c9da8e7-a14d-490e-b4af-8da7c1cc41e9/osano.js
Warning::
External script from cdn.cxense.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.cxense.com/ari-cx.js
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/css/dist/block-library/style.min.css?ver=6.8.5
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.8.5
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/mu-plugins/search/elasticpress/dist/css/related-posts-block-styles.min.css?ver=4.2.2
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/client-mu-plugins/entrepreneur/dist/css/shared.css?ver=d1a06dafad47fdb089c0
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/client-mu-plugins/entrepreneur/dist/css/frontend.css?ver=0501709c2ac12f7de675
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/themes/entrepreneur/dist/css/frontend.css?ver=a82d3c9c326e1ab64f23
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/css/dist/components/style.min.css?ver=6.8.5
Warning::
External link from players.brightcove.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://players.brightcove.net/videojs-pip/1/videojs-pip.css?ver=2.8.8
Warning::
External link from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/plugins/brightcove-video-connect/assets/css/brightcove_playlist.min.css?ver=2.8.8
Warning::
External script from experiments.parsely.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://experiments.parsely.com/vip-experiments.js?apiKey=entrepreneur.com&ver=3.23.1
Warning::
External script from js.hsforms.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: //js.hsforms.net/forms/embed/v2.js
Warning::
External script from securepubads.g.doubleclick.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://securepubads.g.doubleclick.net/tag/js/gpt.js?ver=b0e789987ec84bfbfe2b
Warning::
External script from cdn.adsafeprotected.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.adsafeprotected.com/iasPET.1.js?ver=b0e789987ec84bfbfe2b
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/themes/entrepreneur/dist/js/ads.js?ver=b0e789987ec84bfbfe2b
Warning::
External script from assets.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://assets.entrepreneur.com/ent-components/ent-components-loader.umd.js?ver=1776798360
Warning::
External script from securepubads.g.doubleclick.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604210101/pubads_impl.js?cb=31098008
Warning::
External script from code.jquery.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: //code.jquery.com/jquery-2.2.0.min.js
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/client-mu-plugins/entrepreneur/dist/js/shared.js?ver=d1a06dafad47fdb089c0
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/client-mu-plugins/entrepreneur/dist/js/frontend.js?ver=0501709c2ac12f7de675
Warning::
External script from js.hs-scripts.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://js.hs-scripts.com/21266006.js?integration=WordPress&ver=11.3.45
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/plugins/ad-refresh-control/dist/js/frontend.js?ver=1.1.5
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/mu-plugins/wp-parsely-3.23/build/loader.js?ver=ecf94842061bea03d54b
Warning::
External script from cdn.parsely.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.parsely.com/keys/entrepreneur.com/p.js?ver=3.23.1
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/themes/entrepreneur/dist/js/frontend.js?ver=a82d3c9c326e1ab64f23
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/themes/entrepreneur/dist/js/piano-analytics.js?ver=85676f3fb94746cf8c2b
Warning::
External script from c2.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://c2.entrepreneur.com/xbuilder/experience/load?aid=3CgcRbFCpu&ver=1.1.11
Warning::
External script from s.skimresources.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: //s.skimresources.com/js/143769X1608443.skimlinks.js?ver=1.1.11
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/vendor/react.min.js?ver=18.3.1.1
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=18.3.1.1
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/escape-html.min.js?ver=6561a406d2d232a6fbd2
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/element.min.js?ver=a4eeeadd23c0d7ab1d2d
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/vendor/react-jsx-runtime.min.js?ver=18.3.1
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/dom-ready.min.js?ver=f77871ff7694fffea381
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/a11y.min.js?ver=3156534cc54473497e14
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/deprecated.min.js?ver=e1f84915c5e8ae38964c
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/dom.min.js?ver=80bd57c84b45cf04f4ce
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/is-shallow-equal.min.js?ver=e0f9f1d78d83f5196979
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/keycodes.min.js?ver=034ff647a54b018581d3
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/priority-queue.min.js?ver=9c21c957c7e50ffdbf48
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/compose.min.js?ver=84bcf832a5c99203f3db
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/vendor/moment.min.js?ver=2.30.1
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/date.min.js?ver=85ff222add187a4e358f
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/html-entities.min.js?ver=2cd3358363e0675638fb
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/primitives.min.js?ver=aef2543ab60c8c9bb609
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/private-apis.min.js?ver=0f8478f1ba7e0eea562b
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/redux-routine.min.js?ver=8bb92d45458b29590f53
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/data.min.js?ver=fe6c4835cd00e12493c3
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/rich-text.min.js?ver=74178fc8c4d67d66f1a8
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/warning.min.js?ver=ed7c8b0940914f4fe44b
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-includes/js/dist/components.min.js?ver=865f2ec3b5f5195705e0
Warning::
External script from www.entrepreneur.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.entrepreneur.com/wp-content/themes/entrepreneur/assets/js/date-picker-entry.js?ver=0.1.0
Warning::
External script from stats.wp.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://stats.wp.com/e-202617.js
SRI Coverage 0 / 66 of external resources have integrity hashes
TagDomainIntegrity
<script>auth.entrepreneur.com✗ Missing
<script>api-esp.piano.io✗ Missing
<script>cdn.tinypass.com✗ Missing
<script>js.hubspot.com✗ Missing
<script>js.hscollectedforms.net✗ Missing
<script>js.hsadspixel.net✗ Missing
<script>js.usemessages.com✗ Missing
<script>js.hs-banner.com✗ Missing
<script>experiments.parsely.com✗ Missing
<script>cmp.osano.com✗ Missing
<script>cdn.cxense.com✗ Missing
<link>www.entrepreneur.com✗ Missing
<link>www.entrepreneur.com✗ Missing
<link>www.entrepreneur.com✗ Missing
<link>www.entrepreneur.com✗ Missing
<link>www.entrepreneur.com✗ Missing
<link>www.entrepreneur.com✗ Missing
<link>www.entrepreneur.com✗ Missing
<link>www.entrepreneur.com✗ Missing
<link>players.brightcove.net✗ Missing
<link>www.entrepreneur.com✗ Missing
<script>experiments.parsely.com✗ Missing
<script>js.hsforms.net✗ Missing
<script>securepubads.g.doubleclick.net✗ Missing
<script>cdn.adsafeprotected.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>assets.entrepreneur.com✗ Missing
<script>securepubads.g.doubleclick.net✗ Missing
<script>code.jquery.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>js.hs-scripts.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>cdn.parsely.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>c2.entrepreneur.com✗ Missing
<script>s.skimresources.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>www.entrepreneur.com✗ Missing
<script>stats.wp.com✗ Missing
D
Permissions-Policy
Action
No header set
FIX
No header set
Warning::
No Permissions-Policy header
Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.

No Permissions-Policy header set.

Without this header, embedded iframes can request access to sensitive device features.

Suggested header
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
D
security.txt
Action
No /.well-known/security.txt published
FIX

security.txt

No security.txt found at /.well-known/security.txt

B
Content Security Policy
2 of 10 CSP checks passed
REVIEW
2 of 10 CSP checks passed
Info::
Raw CSP policy
Got: frame-ancestors 'self'
Warning::
default-src directive is missing
default-src provides a fallback for other directives. Set it to restrict default resource loading.
Expected: default-src 'self'
Info::
No script-src or default-src to check for 'unsafe-inline'
Info::
No script-src or default-src to check for 'unsafe-eval'
Info::
No script-src or default-src to check for wildcard
Info::
object-src falls back to default-src
Warning::
base-uri directive is missing
Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.
Expected: base-uri 'self'
Info::
frame-ancestors directive is set
Got: frame-ancestors 'self'
Warning::
form-action directive is missing
form-action restricts where forms can submit data, preventing form hijacking.
Expected: form-action 'self'
Info::
upgrade-insecure-requests is not set
This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.
Expected: upgrade-insecure-requests

default-src provides a fallback for other directives. Set it to restrict default resource loading.

Expected: default-src 'self'
Why this matters

Security gaps expose your site and users to attacks, eroding trust.

Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.

Expected: base-uri 'self'
Why this matters

Missing base-uri in CSP leaves a base-tag injection attack path open even on otherwise strict policies.

Learn more ▾

A common omission: developers add CSP for script-src and frame-ancestors but forget base-uri. The result is a CSP that looks strict but lets an attacker rewrite every URL on the page via <base href>. Add `base-uri 'self'` to close the gap.

Source: MDN CSP

form-action restricts where forms can submit data, preventing form hijacking.

Expected: form-action 'self'
Why this matters

Security gaps expose your site and users to attacks, eroding trust.

This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.

Expected: upgrade-insecure-requests
Why this matters

Without upgrade-insecure-requests, any HTTP subresource link survives as a mixed-content warning instead of auto-upgrading.

Learn more ▾

Adding `upgrade-insecure-requests` to your CSP turns every http:// subresource fetch into https:// at the browser layer. One-line defense against accidental mixed content from legacy links or third-party widgets.

Source: MDN CSP

Parsed Policy

frame-ancestors 'self'
B
CORS Configuration
No CORS headers
REVIEW
No CORS headers
Info::
No CORS headers present — secure default
CORS Configuration ✓ Secure

No CORS headers detected.

Cross-origin requests are blocked by browser same-origin policy.

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
C
Known vulnerability matches
Action
5 known vulnerability match(es) against detected tech
REVIEW

Known Vulnerabilities

LibraryVersionSeveritySummaryFixed In
jQuery2.2.0lowjQuery 1.x and 2.x are End-of-Life and no longer receiving security updates2.999.999
jQuery2.2.0medium3rd party CORS request may execute3.0.0-beta1
jQuery2.2.0mediumjQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution3.4.0
jQuery2.2.0mediumpassing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.3.5.0
jQuery2.2.0mediumRegex in its jQuery.htmlPrefilter sometimes may introduce XSS3.5.0
A+
TLS & Certificates
TLS 1.2, 7 checks passed
PASS
TLS 1.2, 7 checks passed
Info::
TLS 1.2 is used
Got: TLS 1.2
Info::
TLS 1.3 is not negotiated
TLS 1.3 offers improved performance and security. Consider enabling it.
Got: TLS 1.2
Info::
Strong cipher suite is used
Got: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Info::
HTTP/2 is not negotiated
HTTP/2 provides multiplexing and header compression for better performance.
Got: http/1.1
Info::
Certificate is valid (expires in 262 days)
Got: 2027-01-09T19:00:25Z
Info::
Certificate chain has 2 certificates
Info::
Certificate uses modern signature algorithm
Got: SHA256-RSA
Info::
Certificate covers 1 domain(s)
Got: entrepreneur.com
Info::
Certificate is issued by a trusted CA
Got: CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4,O=GlobalSign nv-sa,C=BE

TLS 1.3 offers improved performance and security. Consider enabling it.

Why this matters

TLS 1.3 not in use — connection falls back to 1.2 and pays the extra round-trip.

Learn more ▾

Most clients prefer TLS 1.3 if both sides support it. If your server has TLS 1.3 enabled but it's not being negotiated, check for a downgrade-attack mitigation issue or a misconfigured cipher list. nginx ≥ 1.13.0 and OpenSSL ≥ 1.1.1 support TLS 1.3.

Source: RFC 8446 / Mozilla SSL Config

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection
Protocol
TLS 1.2
Cipher Suite
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
HTTP Version
HTTP/1.1

Certificate Chain

Leaf Certificate
Subject CN=entrepreneur.comIssuer CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4,O=GlobalSign nv-sa,C=BEValid 2025-12-08T19:00:26Z → 2027-01-09T19:00:25ZExpires in 262 days SANs entrepreneur.comSignature SHA256-RSASerial 1c205318b6adab7cffc3c71d1c73796
Intermediate (CA Certificate)
Subject CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4,O=GlobalSign nv-sa,C=BEIssuer CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSignValid 2025-07-16T03:06:35Z → 2027-07-16T00:00:00ZExpires in 450 days Signature SHA256-RSASerial 83da86ab0e31b19d8f03a5edd5bdbd66
A+
JS Library Vulnerabilities
No known vulnerabilities
PASS
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+
Information Leakage
No exposures
PASS
No exposures
Info::
No security.txt found
Consider adding a security.txt at /.well-known/security.txt.
Info::
No sensitive files exposed

No sensitive files exposed — all paths returned 404.

PathStatusCategoryRisk
/.git/HEAD✓ Not foundVersion Control—
/.git/config✓ Not foundVersion Control—
/.svn/entries✓ Not foundVersion Control—
/.env✓ Not foundConfiguration—
/.env.local✓ Not foundConfiguration—
/.env.production✓ Not foundConfiguration—
/wp-config.php✓ Not foundConfiguration—
/.htaccess✓ Not foundConfiguration—
/phpinfo.php✓ Not foundDebug—
/server-status✓ Not foundDebug—
/server-info✓ Not foundDebug—
/.well-known/security.txt✓ Not foundSecurity Policy—
A+
Email Security
DMARC: reject
PASS
DMARC: reject
Info::
DMARC policy is reject — strongest protection
DMARC
Policy reject — strongest protection Record v=DMARC1; p=reject; sp=reject; rua=mailto:re+87f0150b7a5f@inbound.dmarcdigests.com;
A
Transport Security
HTTP/3, HSTS, and TLS version analysis
PASS
HTTP/3, HSTS, and TLS version analysis
Info::
HTTP/3 (QUIC) not advertised
HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.
Info::
HSTS enabled (base policy)
Info::
HSTS missing includeSubDomains
Without includeSubDomains, HSTS only protects the exact domain.
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback