Skip to content
https://x.com

Security

· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.
SCORE
75
GRADE
C
FIX
2
REVIEW
4
PASS
6
INFO
0
Checks
12
6 PASS 4 REVIEW 2 FIX
F
Subresource Integrity
Action
0 of 6 external resources have SRI
FIX
0 of 6 external resources have SRI
Warning::
External link from accounts.google.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://accounts.google.com/gsi/style
Warning::
External script from abs.twimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://abs.twimg.com/responsive-web/client-web/vendor.7ef16aaa.js
Warning::
External script from abs.twimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://abs.twimg.com/responsive-web/client-web/i18n/en.f19ad19a.js
Warning::
External script from abs.twimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://abs.twimg.com/responsive-web/client-web/main.52d81e4a.js
Warning::
External script from accounts.google.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://accounts.google.com/gsi/client
Warning::
External script from appleid.cdn-apple.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js
SRI Coverage 0 / 6 of external resources have integrity hashes
TagDomainIntegrity
<link>accounts.google.com✗ Missing
<script>abs.twimg.com✗ Missing
<script>abs.twimg.com✗ Missing
<script>abs.twimg.com✗ Missing
<script>accounts.google.com✗ Missing
<script>appleid.cdn-apple.com✗ Missing
D
Permissions-Policy
Action
No header set
FIX
No header set
Warning::
No Permissions-Policy header
Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.

No Permissions-Policy header set.

Without this header, embedded iframes can request access to sensitive device features.

Suggested header
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
B
Security Headers
6 of 10 headers properly configured
REVIEW
6 of 10 headers properly configured
Info::
Strict-Transport-Security is properly configured (consider adding preload)
Got: max-age=631138519; includeSubdomains
Info::
X-Content-Type-Options is properly configured
Got: nosniff
Info::
X-Frame-Options is properly configured
Got: DENY
Warning::
Referrer-Policy header is missing
Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.
Expected: strict-origin-when-cross-origin
Warning::
Permissions-Policy header is missing
Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.
Expected: geolocation=(), camera=(), microphone=()
Info::
Content-Security-Policy is present
Got: connect-src 'self' blob: https://fonts.googleapis.com/css https://mapsresources-…
Info::
Cross-Origin-Opener-Policy is set but not 'same-origin'
Got: unsafe-none Expected: same-origin
Info::
Cross-Origin-Embedder-Policy is set
Got: unsafe-none
Warning::
X-Powered-By header reveals technology stack
This header discloses server technology (e.g. Express, PHP), helping attackers target known vulnerabilities. Remove it.
Got: Express
Info::
Server header is present without version info
Got: cloudflare envoy

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin
Why this matters

Default browser behavior leaks full URLs (including query params and tokens) to every third-party resource — set a strict policy.

Learn more ▾

Without a Referrer-Policy header, browsers send the full referring URL with images, scripts, and fonts loaded from third-party origins. URLs containing tokens, user IDs, or session params end up in third-party logs. Set `Referrer-Policy: strict-origin-when-cross-origin` (or stricter) to limit leakage.

Source: MDN / W3C

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()
Why this matters

Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.

Learn more ▾

By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.

Source: MDN / W3C

This header discloses server technology (e.g. Express, PHP), helping attackers target known vulnerabilities. Remove it.

Why this matters

X-Powered-By: PHP/7.4.3 advertises your stack to attackers — disable it.

Learn more ▾

X-Powered-By and similar headers (X-AspNet-Version, X-Runtime) tell attackers which versions to target. Disable in your server/framework config: PHP `expose_php=Off`, ASP.NET `<httpRuntime enableVersionHeader="false">`, Express `app.disable('x-powered-by')`.

Source: OWASP

Expected: same-origin
Why this matters

COOP is set to a less-restrictive value (same-origin-allow-popups or unsafe-none) — partial isolation only.

Learn more ▾

COOP: same-origin is the strictest level. same-origin-allow-popups allows authenticated popup windows back to your origin. unsafe-none is the legacy default (effectively off). Pick the strictest level your app's popup flows tolerate.

Source: MDN COOP

C
Content Security Policy
Action
5 of 10 CSP checks passed
REVIEW
5 of 10 CSP checks passed
Info::
Raw CSP policy
Got: connect-src 'self' blob: https://fonts.googleapis.com/css https://mapsresources-pa.googleapis.com https://maps.googleapis.com https://translate.googleapis.com https://www.gstatic.com/maps/ https://*.pscp.tv https://*.twimg.com https://*.video.pscp.tv https://aa.twitter.com https://aa.x.com https://accounts.google.com/gsi/ https://ads-api.twitter.com https://ads-api.x.com https://api-stream.twitter.com https://api-stream.x.com https://api.twitter.com https://api.x.ai https://api.x.com https://api.x.com https://caps.twitter.com https://caps.x.com https://grok.x.com https://jf.twitter.com https://jf.x.com https://jf-t.x.com https://pay.twitter.com https://pay.x.com https://sentry.io https://ton-staging.atla.twitter.com https://ton-staging.atla.x.com https://ton-staging.pdxa.twitter.com https://ton-staging.pdxa.x.com https://ton.twitter.com https://ton.local.twitter.com https://ton.x.com https://twitter.com https://upload.twitter.com https://upload.x.com https://www.google-analytics.com https://x.com https://grok-api.gcp.mouseion.dev https://assets.mouseion.dev https://grok.com https://assets.grok.com https://imagine-public.x.ai/ wss://grok.com wss://grok-api.gcp.mouseion.dev https://*.adtrafficquality.google https://*.googlesyndication.com https://*.doubleclick.net https://adservice.google.com https://www.googleadservices.com https://pagead2.googlesyndication.com https://www.google.com https://google.com https://via.intercom.io https://api.intercom.io https://api.au.intercom.io https://api.eu.intercom.io https://api-iam.intercom.io https://api-iam.eu.intercom.io https://api-iam.au.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io wss://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io wss://nexus-websocket-b.intercom.io https://nexus-europe-websocket.intercom.io wss://nexus-europe-websocket.intercom.io https://nexus-australia-websocket.intercom.io wss://nexus-australia-websocket.intercom.io https://uploads.intercomcdn.com https://uploads.intercomcdn.eu https://uploads.au.intercomcdn.com https://uploads.eu.intercomcdn.com https://uploads.intercomusercontent.com https://livekit.grok.com wss://livekit.grok.com https://production.plaid.com/ https://sandbox.plaid.com/ https://ingestion.dv.socure.io https://network.dv.socure.io/ https://analytics.dv.socure.io/ https://payments-dev.x.com/customer/wasm/forward-with-v1.wasm https://payments-staging.x.com/customer/wasm/forward-with-v1.wasm https://payments-prod.x.com/customer/wasm/forward-with-v1.wasm https://money-dev.x.com/customer/wasm/forward-with-v1.wasm https://money-staging.x.com/customer/wasm/forward-with-v1.wasm https://money.x.com/customer/wasm/forward-with-v1.wasm https://api.stripe.com https://m.castle.io https://edge.prelude.dev https://checkoutshopper-live.adyen.com wss://*.pscp.tv https://vmap.grabyo.com https://dwo3ckksxlb0v.cloudfront.net https://media.riffsy.com https://*.giphy.com https://media.tenor.com https://c.tenor.com wss://chat-ws.x.com https://d1muhwhmpsz4u8.cloudfront.net/ https://d2bchqfeno8n2m.cloudfront.net/ https://d2shtph9y6bxk.cloudfront.net/ https://xchat-hsm-staging.x.com/ https://realm-a.x.com https://realm-b.x.com https://realm-west1.x.com https://realm-east1.x.com https://hsm-staging.x.com https://ads-twitter.com https://analytics.twitter.com https://analytics.x.com ; default-src 'self'; form-action 'self' https://twitter.com https://*.twitter.com https://x.com https://*.x.com https://localhost.twitter.com:3443 https://localhost.x.com:3443 https://accounts.x.ai https://grok.com https://intercom.help https://api-iam.intercom.io https://api-iam.eu.intercom.io https://api-iam.au.intercom.io; font-src 'self' https://*.twimg.com https://js.intercomcdn.com https://fonts.intercomcdn.com; frame-src 'self' https://accounts.google.com/ https://accounts.google.com/gsi/ https://cards-frame.twitter.com https://cdn.plaid.com/ https://client-api.arkoselabs.com/ https://content.googleapis.com/ https://iframe.arkoselabs.com/ https://mobile.twitter.com https://mobile.x.com https://pay.twitter.com https://pay.x.com https://google.com https://www.google.com https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://console.googletagservices.com https://*.doubleclick.net https://*.adtrafficquality.google https://*.safeframe.googlesyndication.com https://www.googleadservices.com https://googleadservices.com https://adservice.google.com https://*.googlesyndication.com https://td.doubleclick.net https://payments-dev.x.com/ https://payments-staging.x.com/ https://payments-prod.x.com/ https://sdn.payments-dev.x.com/ https://sdn.payments-staging.x.com/ https://sdn.payments-prod.x.com/ https://money-dev.x.com/ https://money-staging.x.com/ https://money.x.com/ https://sdn.money-dev.x.com/ https://sdn.money-staging.x.com/ https://sdn.money.x.com/ https://p2pcreditcardiframesandbox.crbcos.com https://p2pcreditcardiframe.crbcos.com https://verify-sandbox.plaid.com/ https://*.js.stripe.com https://js.stripe.com https://hooks.stripe.com https://cdn.getpinwheel.com/ https://artifacts.grokusercontent.com https://twitter.com https://x.com https://recaptcha.net/recaptcha/; img-src 'self' blob: data: https://www.google.com/maps/place/ https://imgs.search.brave.com https://*.cdn.twitter.com https://*.cdn.x.com https://ton.twitter.com https://ton.x.com https://*.twimg.com https://analytics.twitter.com https://analytics.x.com https://cm.g.doubleclick.net https://www.google-analytics.com https://maps.googleapis.com https://www.periscope.tv https://www.pscp.tv https://ads-twitter.com https://ads-api.twitter.com https://ads-api.x.com https://api.x.com https://developer.x.com blob: data: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://downloads.intercomcdn.eu https://downloads.au.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://video-messages.intercomcdn.com https://messenger-apps.intercom.io https://messenger-apps.eu.intercom.io https://messenger-apps.au.intercom.io https://*.intercom-attachments-1.com https://*.intercom-attachments.eu https://*.au.intercom-attachments.com https://*.intercom-attachments-2.com https://*.intercom-attachments-3.com https://*.intercom-attachments-4.com https://*.intercom-attachments-5.com https://*.intercom-attachments-6.com https://*.intercom-attachments-7.com https://*.intercom-attachments-8.com https://*.intercom-attachments-9.com https://static.intercomassets.eu https://static.au.intercomassets.com https://media.riffsy.com https://*.giphy.com https://media.tenor.com https://c.tenor.com https://*.pscp.tv https://*.periscope.tv https://prod-periscope-profile.s3-us-west-2.amazonaws.com https://platform-lookaside.fbsbx.com https://scontent.xx.fbcdn.net https://scontent-sea1-1.xx.fbcdn.net https://*.googleusercontent.com https://t.co/1/i/adsct https://*.googleusercontent.com https://*.gstatic.com https://*.googlesyndication.com https://*.adtrafficquality.google https://www.google.com/ads/measurement/ https://*.google.com/ads/measurement/ https://googleads.g.doubleclick.net https://google.com https://www.google.com https://plaid-merchant-logos.plaid.com https://plaid-counterparty-logos.plaid.com https://assets.mouseion.dev https://assets.grok.com; manifest-src 'self'; media-src 'self' data: blob: https://twitter.com https://x.com https://*.twimg.com https://*.vine.co https://*.pscp.tv https://*.video.pscp.tv https://js.intercomcdn.com https://downloads.intercomcdn.com https://downloads.intercomcdn.eu https://downloads.au.intercomcdn.com https://dwo3ckksxlb0v.cloudfront.net; object-src 'none'; script-src 'self' 'unsafe-inline' https://*.twimg.com https://recaptcha.net/recaptcha/ http://www.gstatic.com/cast/sdk/libs/caf_receiver/v3/cast_receiver_framework.js https://accounts.google.com/gsi/client https://apis.google.com/js/api.js https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js https://client-api.arkoselabs.com/ https://static.ads-twitter.com https://twitter.com https://www.google-analytics.com https://www.gstatic.com/cast/sdk/libs/caf_receiver/v3/cast_receiver_framework.js https://x.com https://sdn.payments-dev.x.com/assets/loader.min.js https://sdn.payments-staging.x.com/assets/loader.min.js https://sdn.payments-prod.x.com/assets/loader.min.js https://sdn.money-dev.x.com/assets/loader.min.js https://sdn.money-staging.x.com/assets/loader.min.js https://sdn.money.x.com/assets/loader.min.js https://sdk.dv.socure.io/latest/device-risk-sdk.js https://cdn.plaid.com/link/v2/stable/link-initialize.js https://payments-dev.x.com/customer/wasm/xxp-forward-with-sdk.js https://payments-staging.x.com/customer/wasm/xxp-forward-with-sdk.js https://payments-prod.x.com/customer/wasm/xxp-forward-with-sdk.js https://money-dev.x.com/customer/wasm/xxp-forward-with-sdk.js https://money-staging.x.com/customer/wasm/xxp-forward-with-sdk.js https://money.x.com/customer/wasm/xxp-forward-with-sdk.js https://js.stripe.com https://*.js.stripe.com https://cdn.getpinwheel.com/pinwheel-v3.2.1.js https://securepubads.g.doubleclick.net https://www.googletagservices.com https://*.googletagservices.com https://pagead2.googlesyndication.com https://adservice.google.com https://www.googleadservices.com https://ads.google.com https://tpc.googlesyndication.com https://*.tpc.googlesyndication.com https://googleads.g.doubleclick.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com 'wasm-unsafe-eval' 'nonce-ZDM2MzNhYWYtNTZiOC00OWNlLWE5YjgtYjA0ZTc4MGEyOTY1'; style-src 'self' 'unsafe-inline' https://accounts.google.com/gsi/style https://*.twimg.com; child-src 'self' blob:; worker-src 'self' blob:; report-uri https://x.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Info::
default-src directive is set
Got: default-src 'self'
Critical::
'unsafe-inline' found in script source
'unsafe-inline' allows inline <script> tags, defeating CSP against XSS. Remove it and use nonces or hashes instead.
Got: script-src 'self' 'unsafe-inline' https://*.twimg.com https://recaptcha.net/recaptcha/ http://www.gstatic.com/cast/sdk/libs/caf_receiver/v3/cast_receiver_framework.js https://accounts.google.com/gsi/client https://apis.google.com/js/api.js https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js https://client-api.arkoselabs.com/ https://static.ads-twitter.com https://twitter.com https://www.google-analytics.com https://www.gstatic.com/cast/sdk/libs/caf_receiver/v3/cast_receiver_framework.js https://x.com https://sdn.payments-dev.x.com/assets/loader.min.js https://sdn.payments-staging.x.com/assets/loader.min.js https://sdn.payments-prod.x.com/assets/loader.min.js https://sdn.money-dev.x.com/assets/loader.min.js https://sdn.money-staging.x.com/assets/loader.min.js https://sdn.money.x.com/assets/loader.min.js https://sdk.dv.socure.io/latest/device-risk-sdk.js https://cdn.plaid.com/link/v2/stable/link-initialize.js https://payments-dev.x.com/customer/wasm/xxp-forward-with-sdk.js https://payments-staging.x.com/customer/wasm/xxp-forward-with-sdk.js https://payments-prod.x.com/customer/wasm/xxp-forward-with-sdk.js https://money-dev.x.com/customer/wasm/xxp-forward-with-sdk.js https://money-staging.x.com/customer/wasm/xxp-forward-with-sdk.js https://money.x.com/customer/wasm/xxp-forward-with-sdk.js https://js.stripe.com https://*.js.stripe.com https://cdn.getpinwheel.com/pinwheel-v3.2.1.js https://securepubads.g.doubleclick.net https://www.googletagservices.com https://*.googletagservices.com https://pagead2.googlesyndication.com https://adservice.google.com https://www.googleadservices.com https://ads.google.com https://tpc.googlesyndication.com https://*.tpc.googlesyndication.com https://googleads.g.doubleclick.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com 'wasm-unsafe-eval' 'nonce-ZDM2MzNhYWYtNTZiOC00OWNlLWE5YjgtYjA0ZTc4MGEyOTY1'
Info::
No 'unsafe-eval' in script source
Info::
No wildcard in script source
Info::
object-src is set to 'none'
Got: object-src 'none'
Warning::
base-uri directive is missing
Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.
Expected: base-uri 'self'
Warning::
frame-ancestors directive is missing
frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'.
Expected: frame-ancestors 'self'
Info::
form-action directive is set
Got: form-action 'self' https://twitter.com https://*.twitter.com https://x.com https://*.x.com https://localhost.twitter.com:3443 https://localhost.x.com:3443 https://accounts.x.ai https://grok.com https://intercom.help https://api-iam.intercom.io https://api-iam.eu.intercom.io https://api-iam.au.intercom.io
Info::
upgrade-insecure-requests is not set
This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.
Expected: upgrade-insecure-requests

'unsafe-inline' allows inline <script> tags, defeating CSP against XSS. Remove it and use nonces or hashes instead.

Why this matters

Unsafe value (unsafe-inline, unsafe-eval) in script-src defeats CSP's main protection — XSS injections can execute again.

Learn more ▾

unsafe-inline allows inline <script> tags; unsafe-eval allows eval() and similar. Both are necessary for some legacy code but explicitly dangerous. Migrate to nonces (per-page random tokens) or hashes (per-script SHA-256) instead.

Source: OWASP CSP / MDN

Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.

Expected: base-uri 'self'
Why this matters

Missing base-uri in CSP leaves a base-tag injection attack path open even on otherwise strict policies.

Learn more ▾

A common omission: developers add CSP for script-src and frame-ancestors but forget base-uri. The result is a CSP that looks strict but lets an attacker rewrite every URL on the page via <base href>. Add `base-uri 'self'` to close the gap.

Source: MDN CSP

frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'.

Expected: frame-ancestors 'self'
Why this matters

Security gaps expose your site and users to attacks, eroding trust.

This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.

Expected: upgrade-insecure-requests
Why this matters

Without upgrade-insecure-requests, any HTTP subresource link survives as a mixed-content warning instead of auto-upgrading.

Learn more ▾

Adding `upgrade-insecure-requests` to your CSP turns every http:// subresource fetch into https:// at the browser layer. One-line defense against accidental mixed content from legacy links or third-party widgets.

Source: MDN CSP

Parsed Policy

connect-src 'self'blob:https://fonts.googleapis.com/csshttps://mapsresources-pa.googleapis.comhttps://maps.googleapis.comhttps://translate.googleapis.comhttps://www.gstatic.com/maps/https://*.pscp.tvhttps://*.twimg.comhttps://*.video.pscp.tvhttps://aa.twitter.comhttps://aa.x.comhttps://accounts.google.com/gsi/https://ads-api.twitter.comhttps://ads-api.x.comhttps://api-stream.twitter.comhttps://api-stream.x.comhttps://api.twitter.comhttps://api.x.aihttps://api.x.comhttps://api.x.comhttps://caps.twitter.comhttps://caps.x.comhttps://grok.x.comhttps://jf.twitter.comhttps://jf.x.comhttps://jf-t.x.comhttps://pay.twitter.comhttps://pay.x.comhttps://sentry.iohttps://ton-staging.atla.twitter.comhttps://ton-staging.atla.x.comhttps://ton-staging.pdxa.twitter.comhttps://ton-staging.pdxa.x.comhttps://ton.twitter.comhttps://ton.local.twitter.comhttps://ton.x.comhttps://twitter.comhttps://upload.twitter.comhttps://upload.x.comhttps://www.google-analytics.comhttps://x.comhttps://grok-api.gcp.mouseion.devhttps://assets.mouseion.devhttps://grok.comhttps://assets.grok.comhttps://imagine-public.x.ai/wss://grok.comwss://grok-api.gcp.mouseion.devhttps://*.adtrafficquality.googlehttps://*.googlesyndication.comhttps://*.doubleclick.nethttps://adservice.google.comhttps://www.googleadservices.comhttps://pagead2.googlesyndication.comhttps://www.google.comhttps://google.comhttps://via.intercom.iohttps://api.intercom.iohttps://api.au.intercom.iohttps://api.eu.intercom.iohttps://api-iam.intercom.iohttps://api-iam.eu.intercom.iohttps://api-iam.au.intercom.iohttps://api-ping.intercom.iohttps://nexus-websocket-a.intercom.iowss://nexus-websocket-a.intercom.iohttps://nexus-websocket-b.intercom.iowss://nexus-websocket-b.intercom.iohttps://nexus-europe-websocket.intercom.iowss://nexus-europe-websocket.intercom.iohttps://nexus-australia-websocket.intercom.iowss://nexus-australia-websocket.intercom.iohttps://uploads.intercomcdn.comhttps://uploads.intercomcdn.euhttps://uploads.au.intercomcdn.comhttps://uploads.eu.intercomcdn.comhttps://uploads.intercomusercontent.comhttps://livekit.grok.comwss://livekit.grok.comhttps://production.plaid.com/https://sandbox.plaid.com/https://ingestion.dv.socure.iohttps://network.dv.socure.io/https://analytics.dv.socure.io/https://payments-dev.x.com/customer/wasm/forward-with-v1.wasmhttps://payments-staging.x.com/customer/wasm/forward-with-v1.wasmhttps://payments-prod.x.com/customer/wasm/forward-with-v1.wasmhttps://money-dev.x.com/customer/wasm/forward-with-v1.wasmhttps://money-staging.x.com/customer/wasm/forward-with-v1.wasmhttps://money.x.com/customer/wasm/forward-with-v1.wasmhttps://api.stripe.comhttps://m.castle.iohttps://edge.prelude.devhttps://checkoutshopper-live.adyen.comwss://*.pscp.tvhttps://vmap.grabyo.comhttps://dwo3ckksxlb0v.cloudfront.nethttps://media.riffsy.comhttps://*.giphy.comhttps://media.tenor.comhttps://c.tenor.comwss://chat-ws.x.comhttps://d1muhwhmpsz4u8.cloudfront.net/https://d2bchqfeno8n2m.cloudfront.net/https://d2shtph9y6bxk.cloudfront.net/https://xchat-hsm-staging.x.com/https://realm-a.x.comhttps://realm-b.x.comhttps://realm-west1.x.comhttps://realm-east1.x.comhttps://hsm-staging.x.comhttps://ads-twitter.comhttps://analytics.twitter.comhttps://analytics.x.com
default-src 'self'
form-action 'self'https://twitter.comhttps://*.twitter.comhttps://x.comhttps://*.x.comhttps://localhost.twitter.com:3443https://localhost.x.com:3443https://accounts.x.aihttps://grok.comhttps://intercom.helphttps://api-iam.intercom.iohttps://api-iam.eu.intercom.iohttps://api-iam.au.intercom.io
font-src 'self'https://*.twimg.comhttps://js.intercomcdn.comhttps://fonts.intercomcdn.com
frame-src 'self'https://accounts.google.com/https://accounts.google.com/gsi/https://cards-frame.twitter.comhttps://cdn.plaid.com/https://client-api.arkoselabs.com/https://content.googleapis.com/https://iframe.arkoselabs.com/https://mobile.twitter.comhttps://mobile.x.comhttps://pay.twitter.comhttps://pay.x.comhttps://google.comhttps://www.google.comhttps://intercom-sheets.comhttps://www.intercom-reporting.comhttps://www.youtube.comhttps://player.vimeo.comhttps://fast.wistia.nethttps://console.googletagservices.comhttps://*.doubleclick.nethttps://*.adtrafficquality.googlehttps://*.safeframe.googlesyndication.comhttps://www.googleadservices.comhttps://googleadservices.comhttps://adservice.google.comhttps://*.googlesyndication.comhttps://td.doubleclick.nethttps://payments-dev.x.com/https://payments-staging.x.com/https://payments-prod.x.com/https://sdn.payments-dev.x.com/https://sdn.payments-staging.x.com/https://sdn.payments-prod.x.com/https://money-dev.x.com/https://money-staging.x.com/https://money.x.com/https://sdn.money-dev.x.com/https://sdn.money-staging.x.com/https://sdn.money.x.com/https://p2pcreditcardiframesandbox.crbcos.comhttps://p2pcreditcardiframe.crbcos.comhttps://verify-sandbox.plaid.com/https://*.js.stripe.comhttps://js.stripe.comhttps://hooks.stripe.comhttps://cdn.getpinwheel.com/https://artifacts.grokusercontent.comhttps://twitter.comhttps://x.comhttps://recaptcha.net/recaptcha/
img-src 'self'blob:data:https://www.google.com/maps/place/https://imgs.search.brave.comhttps://*.cdn.twitter.comhttps://*.cdn.x.comhttps://ton.twitter.comhttps://ton.x.comhttps://*.twimg.comhttps://analytics.twitter.comhttps://analytics.x.comhttps://cm.g.doubleclick.nethttps://www.google-analytics.comhttps://maps.googleapis.comhttps://www.periscope.tvhttps://www.pscp.tvhttps://ads-twitter.comhttps://ads-api.twitter.comhttps://ads-api.x.comhttps://api.x.comhttps://developer.x.comblob:data:https://js.intercomcdn.comhttps://static.intercomassets.comhttps://downloads.intercomcdn.comhttps://downloads.intercomcdn.euhttps://downloads.au.intercomcdn.comhttps://uploads.intercomusercontent.comhttps://gifs.intercomcdn.comhttps://video-messages.intercomcdn.comhttps://messenger-apps.intercom.iohttps://messenger-apps.eu.intercom.iohttps://messenger-apps.au.intercom.iohttps://*.intercom-attachments-1.comhttps://*.intercom-attachments.euhttps://*.au.intercom-attachments.comhttps://*.intercom-attachments-2.comhttps://*.intercom-attachments-3.comhttps://*.intercom-attachments-4.comhttps://*.intercom-attachments-5.comhttps://*.intercom-attachments-6.comhttps://*.intercom-attachments-7.comhttps://*.intercom-attachments-8.comhttps://*.intercom-attachments-9.comhttps://static.intercomassets.euhttps://static.au.intercomassets.comhttps://media.riffsy.comhttps://*.giphy.comhttps://media.tenor.comhttps://c.tenor.comhttps://*.pscp.tvhttps://*.periscope.tvhttps://prod-periscope-profile.s3-us-west-2.amazonaws.comhttps://platform-lookaside.fbsbx.comhttps://scontent.xx.fbcdn.nethttps://scontent-sea1-1.xx.fbcdn.nethttps://*.googleusercontent.comhttps://t.co/1/i/adscthttps://*.googleusercontent.comhttps://*.gstatic.comhttps://*.googlesyndication.comhttps://*.adtrafficquality.googlehttps://www.google.com/ads/measurement/https://*.google.com/ads/measurement/https://googleads.g.doubleclick.nethttps://google.comhttps://www.google.comhttps://plaid-merchant-logos.plaid.comhttps://plaid-counterparty-logos.plaid.comhttps://assets.mouseion.devhttps://assets.grok.com
manifest-src 'self'
media-src 'self'data:blob:https://twitter.comhttps://x.comhttps://*.twimg.comhttps://*.vine.cohttps://*.pscp.tvhttps://*.video.pscp.tvhttps://js.intercomcdn.comhttps://downloads.intercomcdn.comhttps://downloads.intercomcdn.euhttps://downloads.au.intercomcdn.comhttps://dwo3ckksxlb0v.cloudfront.net
object-src 'none'
script-src 'self''unsafe-inline'https://*.twimg.comhttps://recaptcha.net/recaptcha/http://www.gstatic.com/cast/sdk/libs/caf_receiver/v3/cast_receiver_framework.jshttps://accounts.google.com/gsi/clienthttps://apis.google.com/js/api.jshttps://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.jshttps://client-api.arkoselabs.com/https://static.ads-twitter.comhttps://twitter.comhttps://www.google-analytics.comhttps://www.gstatic.com/cast/sdk/libs/caf_receiver/v3/cast_receiver_framework.jshttps://x.comhttps://sdn.payments-dev.x.com/assets/loader.min.jshttps://sdn.payments-staging.x.com/assets/loader.min.jshttps://sdn.payments-prod.x.com/assets/loader.min.jshttps://sdn.money-dev.x.com/assets/loader.min.jshttps://sdn.money-staging.x.com/assets/loader.min.jshttps://sdn.money.x.com/assets/loader.min.jshttps://sdk.dv.socure.io/latest/device-risk-sdk.jshttps://cdn.plaid.com/link/v2/stable/link-initialize.jshttps://payments-dev.x.com/customer/wasm/xxp-forward-with-sdk.jshttps://payments-staging.x.com/customer/wasm/xxp-forward-with-sdk.jshttps://payments-prod.x.com/customer/wasm/xxp-forward-with-sdk.jshttps://money-dev.x.com/customer/wasm/xxp-forward-with-sdk.jshttps://money-staging.x.com/customer/wasm/xxp-forward-with-sdk.jshttps://money.x.com/customer/wasm/xxp-forward-with-sdk.jshttps://js.stripe.comhttps://*.js.stripe.comhttps://cdn.getpinwheel.com/pinwheel-v3.2.1.jshttps://securepubads.g.doubleclick.nethttps://www.googletagservices.comhttps://*.googletagservices.comhttps://pagead2.googlesyndication.comhttps://adservice.google.comhttps://www.googleadservices.comhttps://ads.google.comhttps://tpc.googlesyndication.comhttps://*.tpc.googlesyndication.comhttps://googleads.g.doubleclick.nethttps://app.intercom.iohttps://widget.intercom.iohttps://js.intercomcdn.com'wasm-unsafe-eval''nonce-ZDM2MzNhYWYtNTZiOC00OWNlLWE5YjgtYjA0ZTc4MGEyOTY1'
style-src 'self''unsafe-inline'https://accounts.google.com/gsi/stylehttps://*.twimg.com
child-src 'self'blob:
worker-src 'self'blob:
report-uri https://x.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
B
CORS Configuration
No CORS headers
REVIEW
No CORS headers
Info::
No CORS headers present — secure default
CORS Configuration ✓ Secure

No CORS headers detected.

Cross-origin requests are blocked by browser same-origin policy.

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
C
security.txt
Action
Expired (2024-01-01T06:00:00.000Z) — update Expires field
REVIEW

security.txt

Contact: https://hackerone.com/twitter
Expires: 2024-01-01T06:00:00.000Z
Encryption: https://twitter.com/security/pgp-key.txt
Policy: https://twitter.com/.well-known/security.txt
A+
TLS & Certificates
TLS 1.3, 7 checks passed
PASS
TLS 1.3, 7 checks passed
Info::
TLS 1.3 is used
Got: TLS 1.3
Info::
Strong cipher suite is used
Got: TLS_AES_128_GCM_SHA256
Info::
HTTP/2 is not negotiated
HTTP/2 provides multiplexing and header compression for better performance.
Got: http/1.1
Info::
Certificate is valid (expires in 72 days)
Got: 2026-06-28T05:27:10Z
Info::
Certificate chain has 2 certificates
Info::
Certificate uses modern signature algorithm
Got: ECDSA-SHA384
Info::
Certificate covers 3 domain(s)
Got: *.x.com, cdn.syndication.x.com, x.com
Info::
Certificate is issued by a trusted CA
Got: CN=E8,O=Let's Encrypt,C=US

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection
Protocol
TLS 1.3
Cipher Suite
TLS_AES_128_GCM_SHA256
HTTP Version
HTTP/1.1

Certificate Chain

Leaf Certificate
Subject CN=x.comIssuer CN=E8,O=Let's Encrypt,C=USValid 2026-03-30T05:27:11Z → 2026-06-28T05:27:10ZExpires in 72 days SANs *.x.com, cdn.syndication.x.com, x.comSignature ECDSA-SHA384Serial 56bc55267d7c6bc7199fe3124e88d44bf25
Intermediate (CA Certificate)
Subject CN=E8,O=Let's Encrypt,C=USIssuer CN=ISRG Root X1,O=Internet Security Research Group,C=USValid 2024-03-13T00:00:00Z → 2027-03-12T23:59:59ZExpires in 330 days Signature SHA256-RSASerial 63959363c24e7082715918bfc3d7ed56
A
Cookie Security
3 cookies analyzed, 6 checks passed
PASS
3 cookies analyzed, 6 checks passed
Info::
Cookie 'guest_id' has the Secure flag
Warning::
Cookie 'guest_id' is missing the HttpOnly flag
Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.
Info::
Cookie 'guest_id' has SameSite=None
Info::
Cookie 'ct0' has the Secure flag
Warning::
Cookie 'ct0' is missing the HttpOnly flag
Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.
Info::
Cookie 'ct0' has SameSite=Lax
Info::
Cookie '__cf_bm' has the Secure flag
Info::
Cookie '__cf_bm' has the HttpOnly flag
Warning::
Cookie '__cf_bm' has no SameSite attribute
Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.
3 cookies analyzed 3 warnings
NameSecureHttpOnlySameSiteSizeIssues
guest_id✓✗None31 B1
ct0✓✗Lax3 B1
__cf_bm✓✓—206 B1
A+
JS Library Vulnerabilities
No known vulnerabilities
PASS
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+
Information Leakage
No exposures
PASS
No exposures
Info::
security.txt is present — good practice
Info::
No sensitive files exposed

No sensitive files exposed — all paths returned 404.

PathStatusCategoryRisk
/.git/HEAD✓ Not foundVersion Control—
/.git/config✓ Not foundVersion Control—
/.svn/entries✓ Not foundVersion Control—
/.env✓ Not foundConfiguration—
/.env.local✓ Not foundConfiguration—
/.env.production✓ Not foundConfiguration—
/wp-config.php✓ Not foundConfiguration—
/.htaccess✓ Not foundConfiguration—
/phpinfo.php✓ Not foundDebug—
/server-status✓ Not foundDebug—
/server-info✓ Not foundDebug—
/.well-known/security.txt✗ ExposedSecurity PolicyInfo
A+
Email Security
DMARC: reject
PASS
DMARC: reject
Info::
DMARC policy is reject — strongest protection
DMARC
Policy reject — strongest protection Record v=DMARC1; p=reject; rua=mailto:caf935f12c8645b2921b0749d1fcd49e@dmarc-reports.cloudflare.net
A
Transport Security
HTTP/3, HSTS, and TLS version analysis
PASS
HTTP/3, HSTS, and TLS version analysis
Info::
HTTP/3 (QUIC) not advertised
HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.
Info::
HSTS enabled (includeSubDomains)
Info::
TLS 1.3 in use (fastest handshake, 1-RTT)
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback