Skip to content
https://cve.org

Security

· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.
SCORE
70
GRADE
C
FIX
3
REVIEW
3
PASS
6
INFO
0
Checks
12
6 PASS 3 REVIEW 3 FIX
F
Content Security Policy
Action
No enforcing CSP policy found
FIX
No enforcing CSP policy found
Critical::
No Content-Security-Policy header found
CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.
Expected: default-src 'self'

CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.

Expected: default-src 'self'
Why this matters

Without a CSP, a single XSS bug can exfiltrate everything users type — credentials, payment data, session tokens.

Learn more ▾

Content-Security-Policy is the browser-enforced firewall against XSS. With a strict CSP, a script injection that would otherwise steal session cookies is silently blocked. Without it, your only defense is hoping every input on every form is escaped correctly forever. Start in Report-Only mode, fix violations, then graduate to enforcing.

Source: OWASP / MDN

F
Subresource Integrity
Action
0 of 2 external resources have SRI
FIX
0 of 2 external resources have SRI
Warning::
External script from cmp.osano.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cmp.osano.com/AzyhULTdPkqmy4aDN/46057d56-0263-4cca-abac-9adddada4f3b/osano.js
Warning::
External script from www.googletagmanager.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.googletagmanager.com/gtag/js?id=G-YNQP3SNVSD&l=dataLayer
SRI Coverage 0 / 2 of external resources have integrity hashes
TagDomainIntegrity
<script>cmp.osano.com✗ Missing
<script>www.googletagmanager.com✗ Missing
F
Email Security
Action
No DMARC
FIX
No DMARC
Warning::
No DMARC record found
Without DMARC, email receivers have no policy for handling authentication failures.
DMARC

No DMARC record found

Without DMARC, email receivers have no policy for handling authentication failures from your domain.

Without DMARC, email receivers have no policy for handling authentication failures.

Why this matters

Without DMARC, anyone can send phishing emails using your domain name.

Learn more ▾

DMARC tells receiving mail servers what to do with email that fails SPF/DKIM checks for your domain. With a strict 'p=reject' policy, spoofed emails get bounced; without it they reach the inbox. Domains used in phishing campaigns lose deliverability and brand trust fast.

Source: DMARC.org / NIST

B
Security Headers
8 of 10 headers properly configured
REVIEW
8 of 10 headers properly configured
Info::
Strict-Transport-Security is properly configured (consider adding preload)
Got: max-age=31536000; includeSubDomains
Info::
X-Content-Type-Options is properly configured
Got: nosniff
Info::
X-Frame-Options is properly configured
Got: DENY
Warning::
Referrer-Policy has a weak value
Got: origin Expected: strict-origin-when-cross-origin
Info::
Permissions-Policy is set
Got: accelerometer=(),ambient-light-sensor=(),autoplay=(),battery=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),gamepad=(),geolocation=(),gyroscope=(),layout-animations=(self),legacy-image-formats=(self),magnetometer=(),microphone=(),midi=(),oversized-images=(self),payment=(),picture-in-picture=(),publickey-credentials-get=(),speaker-selection=(),sync-xhr=(self),unoptimized-images=(self),unsized-media=(self),usb=(),screen-wake-lock=(),web-share=(),xr-spatial-tracking=()
Critical::
Content-Security-Policy header is missing
CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.
Expected: default-src 'self'
Info::
Cross-Origin-Opener-Policy is properly configured
Got: same-origin
Info::
Cross-Origin-Embedder-Policy is set
Got: unsafe-none
Info::
X-Powered-By header is not present
Info::
Server header is present without version info
Got: CloudFront

CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.

Expected: default-src 'self'
Why this matters

Without a CSP, a single XSS bug can exfiltrate everything your users type — including credentials.

Learn more ▾

Content-Security-Policy is the browser-enforced firewall against XSS. With a strict CSP, a script injection that would otherwise steal session cookies or rewrite the page is silently blocked. Without it, your only defense is hoping every input on every form is escaped correctly forever.

Source: OWASP / MDN

Expected: strict-origin-when-cross-origin
Why this matters

Weak Referrer-Policy values leak full URLs (with query params, tokens, IDs) to every third-party resource on the page.

Learn more ▾

Default referrer behavior shares the full referring URL with images, scripts, and other resources from third-party origins. If your URLs contain tokens, session IDs, or user emails (in query strings or paths), every third-party tracker gets them. Set `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).

Source: MDN Referrer-Policy / W3C

B
CORS Configuration
No CORS headers
REVIEW
No CORS headers
Info::
No CORS headers present — secure default
CORS Configuration ✓ Secure

No CORS headers detected.

Cross-origin requests are blocked by browser same-origin policy.

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
B
security.txt
Published with 0 contact(s)
REVIEW

security.txt

A+
TLS & Certificates
TLS 1.3, 7 checks passed
PASS
TLS 1.3, 7 checks passed
Info::
TLS 1.3 is used
Got: TLS 1.3
Info::
Strong cipher suite is used
Got: TLS_AES_128_GCM_SHA256
Info::
HTTP/2 is not negotiated
HTTP/2 provides multiplexing and header compression for better performance.
Got: http/1.1
Info::
Certificate is valid (expires in 199 days)
Got: 2026-11-06T23:59:59Z
Info::
Certificate chain has 3 certificates
Info::
Certificate uses modern signature algorithm
Got: SHA256-RSA
Info::
Certificate covers 2 domain(s)
Got: cve.org, *.cve.org
Info::
Certificate is issued by a trusted CA
Got: CN=Amazon RSA 2048 M01,O=Amazon,C=US

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection
Protocol
TLS 1.3
Cipher Suite
TLS_AES_128_GCM_SHA256
HTTP Version
HTTP/1.1

Certificate Chain

Leaf Certificate
Subject CN=cve.orgIssuer CN=Amazon RSA 2048 M01,O=Amazon,C=USValid 2025-10-08T00:00:00Z → 2026-11-06T23:59:59ZExpires in 199 days SANs cve.org, *.cve.orgSignature SHA256-RSASerial 92a838c4a5ae3e9921b5e9ebe68ce3f
Intermediate (CA Certificate)
Subject CN=Amazon RSA 2048 M01,O=Amazon,C=USIssuer CN=Amazon Root CA 1,O=Amazon,C=USValid 2022-08-23T22:21:28Z → 2030-08-23T22:21:28ZExpires in 1585 days Signature SHA256-RSASerial 77312380b9d6688a33b1ed9bf9ccda68e0e0f
Intermediate (CA Certificate)
Subject CN=Amazon Root CA 1,O=Amazon,C=USIssuer CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=USValid 2015-05-25T12:00:00Z → 2037-12-31T01:00:00ZExpires in 4271 days Signature SHA256-RSASerial 67f944a2a27cdf3fac2ae2b01f908eeb9c4c6
A+
Cookie Security
No cookies set — no cookie security risks
PASS
No cookies set — no cookie security risks
Info::
No cookies set — no cookie security risks

No cookies detected — no cookie security risks to report.

A+
JS Library Vulnerabilities
No known vulnerabilities
PASS
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+
Information Leakage
No exposures
PASS
No exposures
Info::
security.txt is present — good practice
Info::
No sensitive files exposed

No sensitive files exposed — all paths returned 404.

PathStatusCategoryRisk
/.git/HEAD✓ Not foundVersion Control—
/.git/config✓ Not foundVersion Control—
/.svn/entries✓ Not foundVersion Control—
/.env✓ Not foundConfiguration—
/.env.local✓ Not foundConfiguration—
/.env.production✓ Not foundConfiguration—
/wp-config.php✓ Not foundConfiguration—
/.htaccess✓ Not foundConfiguration—
/phpinfo.php✓ Not foundDebug—
/server-status✓ Not foundDebug—
/server-info✓ Not foundDebug—
/.well-known/security.txt✗ ExposedSecurity PolicyInfo
A+
Permissions-Policy
29 directives, 0 missing
PASS
29 directives, 0 missing
Info::
accelerometer=() — blocked for all origins
Info::
ambient-light-sensor=() — blocked for all origins
Info::
autoplay=() — blocked for all origins
Info::
battery=() — blocked for all origins
Info::
camera=() — blocked for all origins
Info::
display-capture=() — blocked for all origins
Info::
document-domain=() — blocked for all origins
Info::
encrypted-media=() — blocked for all origins
Info::
fullscreen=() — blocked for all origins
Info::
gamepad=() — blocked for all origins
Info::
geolocation=() — blocked for all origins
Info::
gyroscope=() — blocked for all origins
Info::
layout-animations=(self)
Info::
legacy-image-formats=(self)
Info::
magnetometer=() — blocked for all origins
Info::
microphone=() — blocked for all origins
Info::
midi=() — blocked for all origins
Info::
oversized-images=(self)
Info::
payment=() — blocked for all origins
Info::
picture-in-picture=() — blocked for all origins
Info::
publickey-credentials-get=() — blocked for all origins
Info::
speaker-selection=() — blocked for all origins
Info::
sync-xhr=(self)
Info::
unoptimized-images=(self)
Info::
unsized-media=(self)
Info::
usb=() — blocked for all origins
Info::
screen-wake-lock=() — blocked for all origins
Info::
web-share=() — blocked for all origins
Info::
xr-spatial-tracking=() — blocked for all origins

Raw Header

accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() fullscreen=() gamepad=() geolocation=() gyroscope=() layout-animations=(self) legacy-image-formats=(self) magnetometer=() microphone=() midi=() oversized-images=(self) payment=() picture-in-picture=() publickey-credentials-get=() speaker-selection=() sync-xhr=(self) unoptimized-images=(self) unsized-media=(self) usb=() screen-wake-lock=() web-share=() xr-spatial-tracking=()

Feature Permissions

Blocked Self Only Unrestricted Not Set
accelerometer Blocked
ambient-light-sensor Blocked
autoplay Blocked
battery Blocked
camera Blocked
display-capture Blocked
document-domain Blocked
encrypted-media Blocked
fullscreen Blocked
gamepad Blocked
geolocation Blocked
gyroscope Blocked
layout-animations Self Only
legacy-image-formats Self Only
magnetometer Blocked
microphone Blocked
midi Blocked
oversized-images Self Only
payment Blocked
picture-in-picture Blocked
publickey-credentials-get Blocked
speaker-selection Blocked
sync-xhr Self Only
unoptimized-images Self Only
unsized-media Self Only
usb Blocked
screen-wake-lock Blocked
web-share Blocked
xr-spatial-tracking Blocked
A
Transport Security
HTTP/3, HSTS, and TLS version analysis
PASS
HTTP/3, HSTS, and TLS version analysis
Info::
HTTP/3 (QUIC) not advertised
HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.
Info::
HSTS enabled (includeSubDomains)
Info::
TLS 1.3 in use (fastest handshake, 1-RTT)
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback