Security

· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.

SCORE

GRADE

FIX

REVIEW

PASS

INFO

Checks

4 PASS 3 REVIEW 5 FIX

Security Headers

Action

2 of 10 headers properly configured

FIX

2 of 10 headers properly configured

HSTS header is missing

Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks. Add the header with a max-age of at least 1 year.

Expected: max-age=31536000; includeSubDomains

X-Content-Type-Options header is missing

This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'.

Expected: nosniff

X-Frame-Options header is missing

This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN.

Expected: DENY

Referrer-Policy header is missing

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin

Permissions-Policy header is missing

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Content-Security-Policy is present

Got: frame-ancestors 'self';

Cross-Origin-Opener-Policy header is missing

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Cross-Origin-Embedder-Policy header is missing

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

X-Powered-By header is not present

Server header reveals version information

The Server header discloses the software version, aiding attackers in targeting known vulnerabilities. Remove the version number.

Got: nginx/1.12.2

Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks. Add the header with a max-age of at least 1 year.

Expected: max-age=31536000; includeSubDomains

Why this matters

Without HSTS, a network attacker can downgrade the very first connection to HTTP and steal the user's session.

Learn more ▾

HSTS tells browsers 'never speak HTTP to this domain again.' Without it, a network attacker (public WiFi, malicious ISP, hostile DNS) intercepts the first HTTP attempt and serves a downgraded version of your site. One header, big surface reduction.

Source: RFC 6797 / OWASP

This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'.

Expected: nosniff

Why this matters

MIME sniffing lets browsers run uploaded files as JavaScript, turning a file upload into an XSS.

Learn more ▾

Setting X-Content-Type-Options: nosniff tells browsers to trust your declared Content-Type instead of guessing. Without it, an attacker who uploads a polyglot file can sometimes get it executed as a script. One header, no downside.

Source: OWASP / MDN

This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN.

Expected: DENY

Why this matters

Without frame protection, your site can be embedded in a hostile page and used for clickjacking.

Learn more ▾

Clickjacking overlays your site under a transparent malicious page so users click invisible buttons. Setting X-Frame-Options: DENY (or a modern frame-ancestors CSP directive) blocks the embedding entirely. There's almost never a legitimate reason to allow it.

Source: OWASP / MDN

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin

Why this matters

Default browser behavior leaks full URLs (including query params and tokens) to every third-party resource — set a strict policy.

Learn more ▾

Without a Referrer-Policy header, browsers send the full referring URL with images, scripts, and fonts loaded from third-party origins. URLs containing tokens, user IDs, or session params end up in third-party logs. Set `Referrer-Policy: strict-origin-when-cross-origin` (or stricter) to limit leakage.

Source: MDN / W3C

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Why this matters

Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.

Learn more ▾

By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.

Source: MDN / W3C

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Why this matters

COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.

Learn more ▾

Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.

Source: MDN / web.dev

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

Why this matters

COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.

Learn more ▾

Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.

Source: MDN / web.dev

The Server header discloses the software version, aiding attackers in targeting known vulnerabilities. Remove the version number.

Why this matters

Server: nginx/1.18.0 tells attackers exactly which CVEs to test — strip the version string.

Learn more ▾

Server version disclosure helps attackers select exploits matching your stack. Configure your server to omit the version (nginx: `server_tokens off;`, Apache: `ServerTokens Prod`). Doesn't fix vulnerabilities but removes the easy reconnaissance step.

Source: OWASP

Subresource Integrity

Action

1 of 70 external resources have SRI

FIX

1 of 70 external resources have SRI

External script from wave.outbrain.com lacks integrity attribute