Skip to content
https://forbes.com

Security

· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.
SCORE
79
GRADE
C
FIX
1
REVIEW
5
PASS
6
INFO
0
Checks
12
6 PASS 5 REVIEW 1 FIX
F
Subresource Integrity
Action
0 of 25 external resources have SRI
FIX
0 of 25 external resources have SRI
Warning::
External script from cdn.ketchjs.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.ketchjs.com/plugins/v1/tcf/stub.js
Warning::
External script from global.ketchcdn.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://global.ketchcdn.com/web/v2/config/forbes/website_smart_tag/boot.js
Warning::
External script from js.datadome.co lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://js.datadome.co/tags.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/polyfills-42372ed130431b0a.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/webpack-b90ff6bfdf3db467.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/framework-f30cbadcebab7629.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/main-a6004c5457d0f87b.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/pages/_app-86e4a0fac32c82b6.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/6cdf2dfb-feb8d9c97c521f8c.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/3297-bf079039fbe7ee2e.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/7235-97c575c28a7c10cd.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/21-e540209ed639d6a4.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/6349-04860aba9bac07c2.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/9204-3d7285779f7e0f1f.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/9946-46abaea941fcbcfe.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/9375-6c52e3ed1a7faf3a.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/82-b2e7c8a7c14d8433.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/5903-4105714ff3140645.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/786-8dd131e762891fdd.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/9006-413a79a03178c12c.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/chunks/pages/homepage-cd26c30859d12f8e.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/l_o4j5EKv6NmLCPN4EdWm/_buildManifest.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/_next/static/l_o4j5EKv6NmLCPN4EdWm/_ssgManifest.js
Warning::
External script from cdn.ketchjs.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.ketchjs.com/ketchtag/stable/v2.12/ketch-sdk.js
Warning::
External script from i.forbesimg.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://i.forbesimg.com/simple-site/dist/js/nextJS-1963499c3b82ccfdd62e.js
SRI Coverage 0 / 25 of external resources have integrity hashes
TagDomainIntegrity
<script>cdn.ketchjs.com✗ Missing
<script>global.ketchcdn.com✗ Missing
<script>js.datadome.co✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>i.forbesimg.com✗ Missing
<script>cdn.ketchjs.com✗ Missing
<script>i.forbesimg.com✗ Missing
B
Security Headers
7 of 10 headers properly configured
REVIEW
7 of 10 headers properly configured
Info::
Strict-Transport-Security is properly configured
Got: max-age=31536000; includeSubDomains; preload
Warning::
X-Content-Type-Options header is missing
This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'.
Expected: nosniff
Info::
X-Frame-Options is properly configured
Got: SAMEORIGIN
Info::
Referrer-Policy is properly configured
Got: strict-origin-when-cross-origin
Info::
Permissions-Policy is set
Got: unload=()
Info::
Content-Security-Policy is present
Got: upgrade-insecure-requests
Warning::
Cross-Origin-Opener-Policy header is missing
COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.
Expected: same-origin
Warning::
Cross-Origin-Embedder-Policy header is missing
COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
Expected: require-corp
Info::
X-Powered-By header is not present
Info::
Server header is present without version info
Got: Varnish

This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'.

Expected: nosniff
Why this matters

MIME sniffing lets browsers run uploaded files as JavaScript, turning a file upload into an XSS.

Learn more ▾

Setting X-Content-Type-Options: nosniff tells browsers to trust your declared Content-Type instead of guessing. Without it, an attacker who uploads a polyglot file can sometimes get it executed as a script. One header, no downside.

Source: OWASP / MDN

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin
Why this matters

COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.

Learn more ▾

Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.

Source: MDN / web.dev

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp
Why this matters

COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.

Learn more ▾

Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.

Source: MDN / web.dev

C
Content Security Policy
Action
2 of 10 CSP checks passed
REVIEW
2 of 10 CSP checks passed
Info::
Raw CSP policy
Got: upgrade-insecure-requests
Warning::
default-src directive is missing
default-src provides a fallback for other directives. Set it to restrict default resource loading.
Expected: default-src 'self'
Info::
No script-src or default-src to check for 'unsafe-inline'
Info::
No script-src or default-src to check for 'unsafe-eval'
Info::
No script-src or default-src to check for wildcard
Info::
object-src falls back to default-src
Warning::
base-uri directive is missing
Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.
Expected: base-uri 'self'
Warning::
frame-ancestors directive is missing
frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'.
Expected: frame-ancestors 'self'
Warning::
form-action directive is missing
form-action restricts where forms can submit data, preventing form hijacking.
Expected: form-action 'self'
Info::
upgrade-insecure-requests is enabled

default-src provides a fallback for other directives. Set it to restrict default resource loading.

Expected: default-src 'self'
Why this matters

Security gaps expose your site and users to attacks, eroding trust.

Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.

Expected: base-uri 'self'
Why this matters

Missing base-uri in CSP leaves a base-tag injection attack path open even on otherwise strict policies.

Learn more ▾

A common omission: developers add CSP for script-src and frame-ancestors but forget base-uri. The result is a CSP that looks strict but lets an attacker rewrite every URL on the page via <base href>. Add `base-uri 'self'` to close the gap.

Source: MDN CSP

frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'.

Expected: frame-ancestors 'self'
Why this matters

Security gaps expose your site and users to attacks, eroding trust.

form-action restricts where forms can submit data, preventing form hijacking.

Expected: form-action 'self'
Why this matters

Security gaps expose your site and users to attacks, eroding trust.

Parsed Policy

upgrade-insecure-requests
C
Permissions-Policy
Action
1 directives, 5 missing
REVIEW
1 directives, 5 missing
Info::
unload=() — blocked for all origins
Info::
camera not restricted
Consider adding camera=() to block camera access from embedded content.
Info::
microphone not restricted
Consider adding microphone=() to block microphone access from embedded content.
Info::
geolocation not restricted
Consider adding geolocation=() to block geolocation access from embedded content.
Info::
payment not restricted
Consider adding payment=() to block payment access from embedded content.
Info::
usb not restricted
Consider adding usb=() to block usb access from embedded content.

Raw Header

unload=()

Feature Permissions

Blocked Self Only Unrestricted Not Set
unload Blocked
camera Not Set
microphone Not Set
geolocation Not Set
payment Not Set
usb Not Set
B
CORS Configuration
No CORS headers
REVIEW
No CORS headers
Info::
No CORS headers present — secure default
CORS Configuration ✓ Secure

No CORS headers detected.

Cross-origin requests are blocked by browser same-origin policy.

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
B
security.txt
Published with 0 contact(s)
REVIEW

security.txt

A+
TLS & Certificates
TLS 1.2, 7 checks passed
PASS
TLS 1.2, 7 checks passed
Info::
TLS 1.2 is used
Got: TLS 1.2
Info::
TLS 1.3 is not negotiated
TLS 1.3 offers improved performance and security. Consider enabling it.
Got: TLS 1.2
Info::
Strong cipher suite is used
Got: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Info::
HTTP/2 is not negotiated
HTTP/2 provides multiplexing and header compression for better performance.
Got: http/1.1
Info::
Certificate is valid (expires in 240 days)
Got: 2026-12-12T19:01:52Z
Info::
Certificate chain has 2 certificates
Info::
Certificate uses modern signature algorithm
Got: SHA256-RSA
Info::
Certificate covers 1 domain(s)
Got: forbes.com
Info::
Certificate is issued by a trusted CA
Got: CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4,O=GlobalSign nv-sa,C=BE

TLS 1.3 offers improved performance and security. Consider enabling it.

Why this matters

TLS 1.3 not in use — connection falls back to 1.2 and pays the extra round-trip.

Learn more ▾

Most clients prefer TLS 1.3 if both sides support it. If your server has TLS 1.3 enabled but it's not being negotiated, check for a downgrade-attack mitigation issue or a misconfigured cipher list. nginx ≥ 1.13.0 and OpenSSL ≥ 1.1.1 support TLS 1.3.

Source: RFC 8446 / Mozilla SSL Config

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection
Protocol
TLS 1.2
Cipher Suite
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
HTTP Version
HTTP/1.1

Certificate Chain

Leaf Certificate
Subject CN=forbes.comIssuer CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4,O=GlobalSign nv-sa,C=BEValid 2025-11-10T19:01:53Z → 2026-12-12T19:01:52ZExpires in 240 days SANs forbes.comSignature SHA256-RSASerial 15856fe205bf0174a89cc0ebf4da166
Intermediate (CA Certificate)
Subject CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4,O=GlobalSign nv-sa,C=BEIssuer CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSignValid 2025-07-16T03:06:35Z → 2027-07-16T00:00:00ZExpires in 456 days Signature SHA256-RSASerial 83da86ab0e31b19d8f03a5edd5bdbd66
A+
Cookie Security
No cookies set — no cookie security risks
PASS
No cookies set — no cookie security risks
Info::
No cookies set — no cookie security risks

No cookies detected — no cookie security risks to report.

A+
JS Library Vulnerabilities
No known vulnerabilities
PASS
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+
Information Leakage
No exposures
PASS
No exposures
Info::
security.txt is present — good practice
Info::
No sensitive files exposed

No sensitive files exposed — all paths returned 404.

PathStatusCategoryRisk
/.git/HEAD✓ Not foundVersion Control—
/.git/config✓ Not foundVersion Control—
/.svn/entries✓ Not foundVersion Control—
/.env✓ Not foundConfiguration—
/.env.local✓ Not foundConfiguration—
/.env.production✓ Not foundConfiguration—
/wp-config.php✓ Not foundConfiguration—
/.htaccess✓ Not foundConfiguration—
/phpinfo.php✓ Not foundDebug—
/server-status✓ Not foundDebug—
/server-info✓ Not foundDebug—
/.well-known/security.txt✗ ExposedSecurity PolicyInfo
A+
Email Security
DMARC: reject
PASS
DMARC: reject
Info::
DMARC policy is reject — strongest protection
DMARC
Policy reject — strongest protection Record v=DMARC1; p=reject; pct=100; rua=mailto:dmarcreports@forbes.com,mailto:69955ab810e8779@rep.dmarcanalyzer.com; ruf=mailto:69955ab810e8779@for.dmarcanalyzer.com; fo=1;
A+
Transport Security
HTTP/3, HSTS, and TLS version analysis
PASS
HTTP/3, HSTS, and TLS version analysis
Info::
HTTP/3 (QUIC) supported
The server advertises HTTP/3 via Alt-Svc for faster connections on mobile networks.
Info::
HSTS enabled (includeSubDomains, preload)
Info::
HSTS preload enabled
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback