Security

· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.

SCORE

GRADE

FIX

REVIEW

PASS

INFO

Checks

6 PASS 2 REVIEW 4 FIX

Security Headers

Action

3 of 10 headers properly configured

FIX

3 of 10 headers properly configured

HSTS max-age is too short (0s, should be ≥ 31536000s)

A short max-age leaves a window for downgrade attacks. Set max-age to at least 31536000 (1 year).

Got: max-age=0 Expected: max-age=31536000; includeSubDomains

X-Content-Type-Options header is missing

This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'.

Expected: nosniff

X-Frame-Options is properly configured

Got: SAMEORIGIN

Referrer-Policy header is missing

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin

Permissions-Policy header is missing

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Content-Security-Policy is present

Got: frame-ancestors 'self'

Cross-Origin-Opener-Policy header is missing

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Cross-Origin-Embedder-Policy header is missing

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

X-Powered-By header reveals technology stack

This header discloses server technology (e.g. Express, PHP), helping attackers target known vulnerabilities. Remove it.

Got: PHP/8.2.7

Server header is present without version info

Got: cloudflare

A short max-age leaves a window for downgrade attacks. Set max-age to at least 31536000 (1 year).

Expected: max-age=31536000; includeSubDomains

Why this matters

Short HSTS max-age leaves a downgrade-attack window every time the cache expires — set ≥ 1 year.

Learn more ▾

max-age below 31536000 (1 year) is below industry recommendation. The browser forgets the HSTS policy and re-exposes first-visit downgrade attacks. Set to 63072000 (2 years) and add `includeSubDomains; preload` to qualify for the HSTS preload list.

Source: RFC 6797 / hstspreload.org

This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'.

Expected: nosniff

Why this matters

MIME sniffing lets browsers run uploaded files as JavaScript, turning a file upload into an XSS.

Learn more ▾

Setting X-Content-Type-Options: nosniff tells browsers to trust your declared Content-Type instead of guessing. Without it, an attacker who uploads a polyglot file can sometimes get it executed as a script. One header, no downside.

Source: OWASP / MDN

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin

Why this matters

Default browser behavior leaks full URLs (including query params and tokens) to every third-party resource — set a strict policy.

Learn more ▾

Without a Referrer-Policy header, browsers send the full referring URL with images, scripts, and fonts loaded from third-party origins. URLs containing tokens, user IDs, or session params end up in third-party logs. Set `Referrer-Policy: strict-origin-when-cross-origin` (or stricter) to limit leakage.

Source: MDN / W3C

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Why this matters

Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.

Learn more ▾

By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.

Source: MDN / W3C

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Why this matters

COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.

Learn more ▾

Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.

Source: MDN / web.dev

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

Why this matters

COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.

Learn more ▾

Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.

Source: MDN / web.dev

This header discloses server technology (e.g. Express, PHP), helping attackers target known vulnerabilities. Remove it.

Why this matters

X-Powered-By: PHP/7.4.3 advertises your stack to attackers — disable it.

Learn more ▾

X-Powered-By and similar headers (X-AspNet-Version, X-Runtime) tell attackers which versions to target. Disable in your server/framework config: PHP `expose_php=Off`, ASP.NET `<httpRuntime enableVersionHeader="false">`, Express `app.disable('x-powered-by')`.

Source: OWASP

Subresource Integrity

Action

0 of 51 external resources have SRI

FIX

0 of 51 external resources have SRI

External script from www.googletagmanager.com lacks integrity attribute