Security

Of 20 third-party `<script>` / `<link rel=stylesheet>` resources, 2 (10%) declare a Subresource Integrity hash via the `integrity=` attribute. SRI binds the page to the exact bytes of the third-party resource: if the CDN is compromised, attacker-modified bytes won't match the declared hash and the browser refuses to execute the resource. Missing SRI on (first 5 examples): - https://connect.facebook.net/signals/config/2659157020855327?v=2.9.433&r=stable&domain=italiainweb.it&hme=4453c87d489b6902031c012cadd2731893cd69feb64fe8a61b339727247a7703&ex_m=118%2C242%2C171%2C27%2C82%2C83%2C162%2C78%2C77%2C11%2C181%2C102%2C20%2C153%2C141%2C46%2C85%2C90%2C149%2C176%2C183%2C8%2C4%2C5%2C7%2C6%2C3%2C103%2C115%2C32%2C17%2C31%2C18%2C33%2C34%2C35%2C37%2C55%2C163%2C87%2C126%2C22%2C24%2C51%2C47%2C49%2C48%2C95%2C104%2C108%2C124%2C160%2C164%2C53%2C125%2C29%2C26%2C133%2C79%2C43%2C166%2C165%2C167%2C157%2C155%2C30%2C42%2C66%2C123%2C178%2C80%2C21%2C128%2C93%2C76%2C23%2C97%2C98%2C130%2C96%2C151%2C150%2C154%2C109%2C177%2C180%2C41%2C56%2C127%2C54%2C161%2C72%2C185%2C110%2C184%2C211%2C263%2C84%2C283%2C282%2C281%2C14%2C25%2C28%2C40%2C62%2C117%2C68%2C10%2C73%2C111%2C112%2C113%2C119%2C144%2C38%2C36%2C146%2C147%2C148%2C143%2C142%2C172%2C86%2C175%2C173%2C174%2C57%2C69%2C67%2C137%2C19%2C179%2C52%2C333%2C334%2C335%2C332%2C349%2C371%2C256%2C238%2C70%2C239%2C237%2C374%2C365%2C59%2C257%2C121%2C145%2C92%2C135%2C61%2C134%2C140%2C139%2C65%2C74%2C168%2C88%2C89%2C129%2C44%2C39%2C60%2C63%2C114%2C182%2C1%2C138%2C16%2C136%2C12%2C2%2C64%2C105%2C15%2C75%2C71%2C132%2C101%2C100%2C187%2C188%2C106%2C107%2C9%2C116%2C186%2C58%2C158%2C99%2C91%2C81%2C131%2C120%2C169%2C50%2C159%2C0%2C94%2C152%2C156%2C170%2C45%2C122%2C13%2C189 - https://connect.facebook.net/en_US/fbevents.js - https://consent.cookiebot.eu/0412a154-7374-4f7d-8988-a83f26fc7d78/cc.js?renew=false&referer=italiainweb.it&dnt=false&init=false - https://pixel.byspotify.com/ping.min.js - https://www.googletagmanager.com/gtag/js?id=G-KLTYDR7Z1P&cx=c&gtm=4e6au1 Fix: add `integrity="sha384-..."` and `crossorigin="anonymous"` attributes. Generators: srihash.org, or in-browser via `await crypto.subtle.digest('SHA-384', bytes)`. Cache-bust the resource URL when you change versions, since the integrity hash will mismatch with old cached bytes.

Each disclosed version enables direct CVE lookup -- an attacker who knows you run WordPress 6.4.2 (or whatever specific version) can search the CVE database for known exploits and target accordingly. Remove via your CMS config: WordPress (`remove_action('wp_head', 'wp_generator')`); Drupal (System / Reports / Status report -> Hide generator); Joomla (Global Configuration -> Hide generator); Hugo/Jekyll (delete or override the {{ .Site.Generator }} template hook). For HTML comments, audit your template files directly.

Without SRI, if this CDN is compromised, attackers could inject malicious code.

This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject after monitoring DMARC reports.

Without includeSubDomains, subdomains can still be accessed over HTTP.

Response headers don't match any known WAF or bot-management product. Sites exposed to abuse (login, signup, payment) typically benefit from a WAF such as Cloudflare, Akamai, AWS WAF, or Imperva.

security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field.

Without rel="noopener", the destination tab can navigate the original tab via window.opener -- a reverse-tabnabbing phishing primitive. Modern browsers default to noopener since Chrome 88 / Firefox 79 / Safari 12.1, but explicit rel="noopener noreferrer" remains the documented best practice for older browsers, in-app webviews, and security scanners.

Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 26 inline style(s) is moderate. Affected element types include: svg, p, div, span. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win.

Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode.

The Permissions-Policy header explicitly declares policies for 10/10 high-risk features. Covered: camera, microphone, geolocation, payment, usb, serial, midi, accelerometer, gyroscope, magnetometer Not declared (default-allow): The non-declared features fall back to their spec-default policy (usually `self`), which means an XSS-injected or compromised iframe could request them. For features the page genuinely doesn't use, declare `feature=()` to fully close them.

The modern browser default (Chrome 85+, Firefox 87+, Safari 15+). Full URL Referer on same-origin; origin only on cross-origin; no Referer on HTTPS-to-HTTP downgrade. Privacy-safe and breaks no analytics. The recommended explicit value.

Consider adding a security.txt at /.well-known/security.txt.

The server advertises HTTP/3 via Alt-Svc for faster connections on mobile networks.