Security - https://ucalgary.ca BeaverCheck Audit

F

Subresource Integrity

Action

0 of 25 external resources have SRI

FIX

0 of 25 external resources have SRI

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtag/destination?id=DC-9811133&cx=c&gtm=4e64h1

External script from connect.facebook.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://connect.facebook.net/signals/config/363404262936571?v=2.9.303&r=stable&domain=ucalgary.ca&hme=97937018cefade17726f0472876fc101316b2ce9008a35a6a5a7977d7436151a&ex_m=104%2C205%2C154%2C22%2C72%2C73%2C145%2C68%2C67%2C11%2C162%2C90%2C16%2C138%2C127%2C39%2C75%2C78%2C134%2C159%2C164%2C8%2C4%2C5%2C7%2C6%2C3%2C91%2C101%2C165%2C170%2C219%2C62%2C186%2C187%2C55%2C276%2C30%2C74%2C231%2C230%2C229%2C23%2C33%2C103%2C61%2C10%2C63%2C97%2C98%2C99%2C105%2C130%2C31%2C29%2C132%2C133%2C129%2C128%2C155%2C76%2C158%2C156%2C157%2C50%2C60%2C123%2C15%2C161%2C45%2C263%2C264%2C262%2C26%2C27%2C28%2C48%2C146%2C77%2C112%2C18%2C20%2C44%2C40%2C42%2C41%2C83%2C92%2C96%2C110%2C144%2C147%2C46%2C111%2C24%2C21%2C119%2C69%2C36%2C149%2C148%2C150%2C141%2C139%2C25%2C35%2C59%2C109%2C160%2C70%2C17%2C152%2C114%2C81%2C66%2C19%2C85%2C86%2C116%2C84%2C136%2C135%2C34%2C278%2C293%2C212%2C201%2C202%2C200%2C296%2C288%2C52%2C213%2C107%2C131%2C80%2C121%2C54%2C47%2C49%2C113%2C120%2C126%2C58%2C64%2C151%2C115%2C37%2C32%2C53%2C56%2C100%2C163%2C1%2C124%2C14%2C122%2C12%2C2%2C57%2C93%2C65%2C118%2C89%2C88%2C166%2C167%2C94%2C95%2C9%2C125%2C102%2C51%2C142%2C87%2C79%2C71%2C117%2C106%2C43%2C143%2C0%2C82%2C137%2C140%2C153%2C38%2C108%2C13%2C168

External script from connect.facebook.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://connect.facebook.net/en_US/fbevents.js

External script from static.ads-twitter.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://static.ads-twitter.com/uwt.js

External script from snap.licdn.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://snap.licdn.com/li.lms-analytics/insight.min.js

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtag/js?id=DC-16658738&cx=c&gtm=4e64h1

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtm.js?id=GTM-K9DHDQH

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtm.js?id=GTM-PTFSDQ5P

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtag/js?id=G-5GBFLEGM04&cx=c&gtm=4e64h1

External script from www.youtube.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.youtube.com/s/player/218d9d92/www-widgetapi.vflset/www-widgetapi.js

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtag/js?id=G-HZDE2J4REE&cx=c&gtm=4e64h1

External script from www.youtube.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.youtube.com/iframe_api

External script from www.youtube.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.youtube.com/iframe_api

External script from scripts.clarity.ms lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://scripts.clarity.ms/0.8.60-beta/clarity.js

External script from www.clarity.ms lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.clarity.ms/tag/tygme2nb0t

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtm.js?id=GTM-PSTK4ZT5

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtm.js?id=GTM-5FZ5QDWC

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtag/js?id=G-X4GN9Y4W7D

External link from use.typekit.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://use.typekit.net/yam6tmr.css

External link from events.ucalgary.ca lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://events.ucalgary.ca/live/resource/css/%5Clivewhale%5Ctheme%5Cglobal%5Cstyles%5Cwidgets.css

External script from events.ucalgary.ca lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://events.ucalgary.ca/live/resource/js/%5Clivewhale%5Cthirdparty%5Cjquery%5Cjquery.no-conflict-header.js/%5Clivewhale%5Cthirdparty%5Cjquery%5Cjquery.js/%5Clivewhale%5Cthirdparty%5Cjquery%5Cjquery.no-conflict-footer.js/%5Clivewhale%5Cscripts%5Clib%5Cdate%5Cformatter.js/%5Clivewhale%5Cscripts%5Clib%5Cdate%5Ctimezone.js/%5Clivewhale%5Cscripts%5Clib%5Cdate%5Cuser.js/%5Clivewhale%5Cplugins%5Cjquery%5Cjquery.lw-widget.js

External script from events.ucalgary.ca lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://events.ucalgary.ca/livewhale/theme/core/scripts/lwcw.js

External script from api.useberry.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://api.useberry.com/integrations/liveUrl/scripts/useberryScript.js

External script from api.useberry.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://api.useberry.com/integrations/liveUrl/scripts/useberryScript.js

External script from api.useberry.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://api.useberry.com/integrations/liveUrl/scripts/useberryScript.js

SRI Coverage 0 / 25 of external resources have integrity hashes

Tag	Domain	Integrity
<script>	www.googletagmanager.com	✗ Missing
<script>	connect.facebook.net	✗ Missing
<script>	connect.facebook.net	✗ Missing
<script>	static.ads-twitter.com	✗ Missing
<script>	snap.licdn.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	www.youtube.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	www.youtube.com	✗ Missing
<script>	www.youtube.com	✗ Missing
<script>	scripts.clarity.ms	✗ Missing
<script>	www.clarity.ms	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<link>	use.typekit.net	✗ Missing
<link>	events.ucalgary.ca	✗ Missing
<script>	events.ucalgary.ca	✗ Missing
<script>	events.ucalgary.ca	✗ Missing
<script>	api.useberry.com	✗ Missing
<script>	api.useberry.com	✗ Missing
<script>	api.useberry.com	✗ Missing

D

Permissions-Policy

Action

No header set

FIX

No header set

No Permissions-Policy header

Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.

No Permissions-Policy header set.

Without this header, embedded iframes can request access to sensitive device features.

Suggested header

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

C

Security Headers

Action

6 of 10 headers properly configured

REVIEW

6 of 10 headers properly configured

Strict-Transport-Security is properly configured (consider adding preload)

Got: max-age=31536000; includeSubDomains

X-Content-Type-Options is properly configured

Got: nosniff

X-Frame-Options is properly configured

Got: SAMEORIGIN

Referrer-Policy header is missing

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin

Permissions-Policy header is missing

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Content-Security-Policy is present

Got: frame-ancestors default-src 'self' https://d2l.ucalgary.ca;

Cross-Origin-Opener-Policy header is missing

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Cross-Origin-Embedder-Policy header is missing

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

X-Powered-By header is not present

Server header is not present

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin

Why this matters

Default browser behavior leaks full URLs (including query params and tokens) to every third-party resource — set a strict policy.

Learn more ▾

Without a Referrer-Policy header, browsers send the full referring URL with images, scripts, and fonts loaded from third-party origins. URLs containing tokens, user IDs, or session params end up in third-party logs. Set `Referrer-Policy: strict-origin-when-cross-origin` (or stricter) to limit leakage.

Source: MDN / W3C

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Why this matters

Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.

Learn more ▾

By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.

Source: MDN / W3C

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Why this matters

COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.

Learn more ▾

Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.

Source: MDN / web.dev

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

Why this matters

COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.

Learn more ▾

Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.

Source: MDN / web.dev

B

Content Security Policy

2 of 10 CSP checks passed

REVIEW

2 of 10 CSP checks passed

Raw CSP policy

Got: frame-ancestors default-src 'self' https://d2l.ucalgary.ca;

default-src directive is missing

default-src provides a fallback for other directives. Set it to restrict default resource loading.

Expected: default-src 'self'

No script-src or default-src to check for 'unsafe-inline'

No script-src or default-src to check for 'unsafe-eval'

No script-src or default-src to check for wildcard

object-src falls back to default-src

base-uri directive is missing

Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.

Expected: base-uri 'self'

frame-ancestors directive is set

Got: frame-ancestors default-src 'self' https://d2l.ucalgary.ca

form-action directive is missing

form-action restricts where forms can submit data, preventing form hijacking.

Expected: form-action 'self'

upgrade-insecure-requests is not set

This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.

Expected: upgrade-insecure-requests

default-src provides a fallback for other directives. Set it to restrict default resource loading.

Expected: default-src 'self'

Why this matters

Security gaps expose your site and users to attacks, eroding trust.

Without base-uri, attackers can inject a <base> tag to hijack relative URLs. Set it to 'self' or 'none'.

Expected: base-uri 'self'

Why this matters

Missing base-uri in CSP leaves a base-tag injection attack path open even on otherwise strict policies.

Learn more ▾

A common omission: developers add CSP for script-src and frame-ancestors but forget base-uri. The result is a CSP that looks strict but lets an attacker rewrite every URL on the page via <base href>. Add `base-uri 'self'` to close the gap.

Source: MDN CSP

form-action restricts where forms can submit data, preventing form hijacking.

Expected: form-action 'self'

Why this matters

Security gaps expose your site and users to attacks, eroding trust.

This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.

Expected: upgrade-insecure-requests

Why this matters

Without upgrade-insecure-requests, any HTTP subresource link survives as a mixed-content warning instead of auto-upgrading.

Learn more ▾

Adding `upgrade-insecure-requests` to your CSP turns every http:// subresource fetch into https:// at the browser layer. One-line defense against accidental mixed content from legacy links or third-party widgets.

Source: MDN CSP

Parsed Policy

frame-ancestors default-src'self'https://d2l.ucalgary.ca

C

CORS Configuration

Action

Origin: *

REVIEW

Origin: *

Access-Control-Allow-Origin: * — unrestricted

Any website can read this resource's response. Appropriate for public APIs but not for user-specific content.

Origin reflection not testable with a single request

Some servers reflect the request Origin header. This requires manual testing with a crafted Origin header.

CORS Configuration Permissive

Allow-Origin *

Any website can read responses from this resource.

Header	Value	Status
Access-Control-Allow-Origin	*	⚠

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control

C

security.txt

Action

Expired (2025-12-31T23:00:00Z) — update Expires field

REVIEW

security.txt

Contact: mailto:abuse@ucalgary.ca, https://ucalgary.service-now.com/it?id=kb_article&sys_id=b099fb0f1bf591d022ba4158dc4bcb08

Expires: 2025-12-31T23:00:00Z

Policy: https://www.ucalgary.ca/.well-known/security.txt

A+

TLS & Certificates

TLS 1.3, 7 checks passed

PASS

TLS 1.3, 7 checks passed

TLS 1.3 is used

Got: TLS 1.3

Strong cipher suite is used

Got: TLS_CHACHA20_POLY1305_SHA256

HTTP/2 is not negotiated

HTTP/2 provides multiplexing and header compression for better performance.

Got: http/1.1

Certificate is valid (expires in 255 days)

Got: 2027-01-01T23:59:59Z

Certificate chain has 4 certificates

Certificate uses modern signature algorithm

Got: SHA256-RSA

Certificate covers 136 domain(s)

Got: ucalgary.ca, aboriginallynxjobs.ucalgary.ca, academic-plan.ucalgary.ca, activeliving.ucalgary.ca, addiction.ucalgary.ca, alumni.ucalgary.ca, antao.ucalgary.ca, archives.ucalgary.ca, archmagazine.ucalgary.ca, aro.med.ucalgary.ca, arotest.ucalgary.ca, arts.ucalgary.ca, asc.ucalgary.ca, banffpathology.ucalgary.ca, bebblab.ucalgary.ca, bgs.ucalgary.ca, bio.ucalgary.ca, biotech.ucalgary.ca, blackboard.ucalgary.ca, bonelab.ucalgary.ca, bookstore.ucalgary.ca, caa.ucalgary.ca, ccdl.ucalgary.ca, cellbiology.ucalgary.ca, charbonneau.ucalgary.ca, cisac.ucalgary.ca, cmd.ucalgary.ca, cme.ucalgary.ca, cmrcentre.ucalgary.ca, cmsa.ucalgary.ca, covidsafe-campus-test.ucalgary.ca, cps.enel.ucalgary.ca, cumming.ucalgary.ca, dprg.geomatics.ucalgary.ca, educ.ucalgary.ca, education.ucalgary.ca, efwr.ucalgary.ca, ehssuite.ucalgary.ca, elearn.ucalgary.ca, elearning.ucalgary.ca, elluminate.ucalgary.ca, emergingalberta.ucalgary.ca, emeriti.ucalgary.ca, emeritus.ucalgary.ca, enel.ucalgary.ca, energy.ucalgary.ca, eng.ucalgary.ca, engg.ucalgary.ca, ess.ucalgary.ca, evds.ucalgary.ca, ez1.lib.ucalgary.ca, fsw.ucalgary.ca, geomatics.ucalgary.ca, geoscience.ucalgary.ca, gess.geomatics.ucalgary.ca, givingday.ucalgary.ca, glanslookdatabase.ucalgary.ca, grad.ucalgary.ca, hamlet.ucalgary.ca, haskayne.ucalgary.ca, haskaynejobs.ucalgary.ca, hbi.ucalgary.ca, hbito.ucalgary.ca, hinc.ucalgary.ca, hom.ucalgary.ca, hpc.ucalgary.ca, ibi.ucalgary.ca, icrp.ucalgary.ca, ieee.enel.ucalgary.ca, iiirr.ucalgary.ca, imagine.ucalgary.ca, iph.ucalgary.ca, iradio.ucalgary.ca, it.ucalgary.ca, itl.ucalgary.ca, jobs.ucalgary.ca, kb.ucalgary.ca, kfs.ucalgary.ca, law.ucalgary.ca, lcr.ucalgary.ca, libin.ucalgary.ca, lllp.ucalgary.ca, marketo.ucalgary.ca, math.ucalgary.ca, mathison.ucalgary.ca, mccaig.ucalgary.ca, medicine.ucalgary.ca, micro.ucalgary.ca, microscopy.ucalgary.ca, mms.geomatics.ucalgary.ca, moose.bio.ucalgary.ca, nickle.ucalgary.ca, nserccreate.kin.ucalgary.ca, nursing.ucalgary.ca, obrieniph.ucalgary.ca, office365.ucalgary.ca, oia.ucalgary.ca, open.ucalgary.ca, ortho.ucalgary.ca, oval.ucalgary.ca, pathology.ucalgary.ca, peermentoring.ucalgary.ca, phas.ucalgary.ca, pip.ucalgary.ca, print.ucalgary.ca, qis.ucalgary.ca, remote.ucalgary.ca, research4kids.ucalgary.ca, sacri.ucalgary.ca, sapl.ucalgary.ca, schulich.ucalgary.ca, science.ucalgary.ca, senate.ucalgary.ca, shsgrp.geomatics.ucalgary.ca, signaturelearning.ucalgary.ca, snyder.ucalgary.ca, socialwork.ucalgary.ca, solar.ucalgary.ca, sportmed.ucalgary.ca, springsummer.ucalgary.ca, static.ucalgary.ca, students.ucalgary.ca, taylorinstitute.ucalgary.ca, tfdl.ucalgary.ca, tfl.ucalgary.ca, thepitstop.ucalgary.ca, tlsdatabase.ucalgary.ca, universitypublications.ucalgary.ca, upo.ucalgary.ca, usc.ucalgary.ca, vet.ucalgary.ca, web.ucalgary.ca, webblab.ucalgary.ca, werklund.ucalgary.ca, winstonlab.ucalgary.ca, www.ucalgary.ca

Certificate is issued by a trusted CA

Got: CN=Entrust EV TLS Issuing RSA CA 2,O=Entrust Limited,C=CA

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection

Protocol

TLS 1.3

Cipher Suite

TLS_CHACHA20_POLY1305_SHA256

HTTP Version

HTTP/1.1

Certificate Chain

Leaf Certificate

Subject SERIALNUMBER=108102864 RR 0001,CN=ucalgary.ca,O=The Governors of the University of Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341Issuer CN=Entrust EV TLS Issuing RSA CA 2,O=Entrust Limited,C=CAValid 2025-12-01T00:00:00Z → 2027-01-01T23:59:59ZExpires in 255 days SANs ucalgary.ca, aboriginallynxjobs.ucalgary.ca, academic-plan.ucalgary.ca, activeliving.ucalgary.ca, addiction.ucalgary.ca, alumni.ucalgary.ca, antao.ucalgary.ca, archives.ucalgary.ca, archmagazine.ucalgary.ca, aro.med.ucalgary.ca, arotest.ucalgary.ca, arts.ucalgary.ca, asc.ucalgary.ca, banffpathology.ucalgary.ca, bebblab.ucalgary.ca, bgs.ucalgary.ca, bio.ucalgary.ca, biotech.ucalgary.ca, blackboard.ucalgary.ca, bonelab.ucalgary.ca, bookstore.ucalgary.ca, caa.ucalgary.ca, ccdl.ucalgary.ca, cellbiology.ucalgary.ca, charbonneau.ucalgary.ca, cisac.ucalgary.ca, cmd.ucalgary.ca, cme.ucalgary.ca, cmrcentre.ucalgary.ca, cmsa.ucalgary.ca, covidsafe-campus-test.ucalgary.ca, cps.enel.ucalgary.ca, cumming.ucalgary.ca, dprg.geomatics.ucalgary.ca, educ.ucalgary.ca, education.ucalgary.ca, efwr.ucalgary.ca, ehssuite.ucalgary.ca, elearn.ucalgary.ca, elearning.ucalgary.ca, elluminate.ucalgary.ca, emergingalberta.ucalgary.ca, emeriti.ucalgary.ca, emeritus.ucalgary.ca, enel.ucalgary.ca, energy.ucalgary.ca, eng.ucalgary.ca, engg.ucalgary.ca, ess.ucalgary.ca, evds.ucalgary.ca, ez1.lib.ucalgary.ca, fsw.ucalgary.ca, geomatics.ucalgary.ca, geoscience.ucalgary.ca, gess.geomatics.ucalgary.ca, givingday.ucalgary.ca, glanslookdatabase.ucalgary.ca, grad.ucalgary.ca, hamlet.ucalgary.ca, haskayne.ucalgary.ca, haskaynejobs.ucalgary.ca, hbi.ucalgary.ca, hbito.ucalgary.ca, hinc.ucalgary.ca, hom.ucalgary.ca, hpc.ucalgary.ca, ibi.ucalgary.ca, icrp.ucalgary.ca, ieee.enel.ucalgary.ca, iiirr.ucalgary.ca, imagine.ucalgary.ca, iph.ucalgary.ca, iradio.ucalgary.ca, it.ucalgary.ca, itl.ucalgary.ca, jobs.ucalgary.ca, kb.ucalgary.ca, kfs.ucalgary.ca, law.ucalgary.ca, lcr.ucalgary.ca, libin.ucalgary.ca, lllp.ucalgary.ca, marketo.ucalgary.ca, math.ucalgary.ca, mathison.ucalgary.ca, mccaig.ucalgary.ca, medicine.ucalgary.ca, micro.ucalgary.ca, microscopy.ucalgary.ca, mms.geomatics.ucalgary.ca, moose.bio.ucalgary.ca, nickle.ucalgary.ca, nserccreate.kin.ucalgary.ca, nursing.ucalgary.ca, obrieniph.ucalgary.ca, office365.ucalgary.ca, oia.ucalgary.ca, open.ucalgary.ca, ortho.ucalgary.ca, oval.ucalgary.ca, pathology.ucalgary.ca, peermentoring.ucalgary.ca, phas.ucalgary.ca, pip.ucalgary.ca, print.ucalgary.ca, qis.ucalgary.ca, remote.ucalgary.ca, research4kids.ucalgary.ca, sacri.ucalgary.ca, sapl.ucalgary.ca, schulich.ucalgary.ca, science.ucalgary.ca, senate.ucalgary.ca, shsgrp.geomatics.ucalgary.ca, signaturelearning.ucalgary.ca, snyder.ucalgary.ca, socialwork.ucalgary.ca, solar.ucalgary.ca, sportmed.ucalgary.ca, springsummer.ucalgary.ca, static.ucalgary.ca, students.ucalgary.ca, taylorinstitute.ucalgary.ca, tfdl.ucalgary.ca, tfl.ucalgary.ca, thepitstop.ucalgary.ca, tlsdatabase.ucalgary.ca, universitypublications.ucalgary.ca, upo.ucalgary.ca, usc.ucalgary.ca, vet.ucalgary.ca, web.ucalgary.ca, webblab.ucalgary.ca, werklund.ucalgary.ca, winstonlab.ucalgary.ca, www.ucalgary.caSignature SHA256-RSASerial e773fb95b65974ca6b20f54f9e3ccdc7

Intermediate (CA Certificate)

Subject CN=Entrust EV TLS Issuing RSA CA 2,O=Entrust Limited,C=CAIssuer CN=Sectigo Public Server Authentication Root R46,O=Sectigo Limited,C=GBValid 2024-12-11T00:00:00Z → 2027-12-10T23:59:59ZExpires in 598 days Signature SHA384-RSASerial bf33d4bd7deeb535281c926d9f4bbe3e

Intermediate (CA Certificate)

Subject CN=Sectigo Public Server Authentication Root R46,O=Sectigo Limited,C=GBIssuer CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USValid 2021-03-22T00:00:00Z → 2038-01-18T23:59:59ZExpires in 4290 days Signature SHA384-RSASerial d27fbbc1de359e5216ad6149586099c4

Intermediate (CA Certificate)

Subject CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USIssuer CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USValid 2010-02-01T00:00:00Z → 2038-01-18T23:59:59ZExpires in 4290 days Signature SHA384-RSASerial 1fd6d30fca3ca51a81bbc640e35032d

A+

Cookie Security

No cookies set — no cookie security risks

PASS

No cookies set — no cookie security risks

No cookies detected — no cookie security risks to report.

A+

JS Library Vulnerabilities

No known vulnerabilities

PASS

No known vulnerabilities

No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+

Information Leakage

No exposures

PASS

No exposures

security.txt is present — good practice

No sensitive files exposed

No sensitive files exposed — all paths returned 404.

Path	Status	Category	Risk
/.git/HEAD	✓ Not found	Version Control	—
/.git/config	✓ Not found	Version Control	—
/.svn/entries	✓ Not found	Version Control	—
/.env	✓ Not found	Configuration	—
/.env.local	✓ Not found	Configuration	—
/.env.production	✓ Not found	Configuration	—
/wp-config.php	✓ Not found	Configuration	—
/.htaccess	✓ Not found	Configuration	—
/phpinfo.php	✓ Not found	Debug	—
/server-status	✓ Not found	Debug	—
/server-info	✓ Not found	Debug	—
/.well-known/security.txt	✗ Exposed	Security Policy	Info

A

Email Security

DMARC: quarantine

PASS

DMARC: quarantine

DMARC policy is quarantine — good protection

DMARC

Policy quarantine — good protection Record v=DMARC1;p=quarantine;rua=mailto:dmarc.aggregate@ucalgary.ca;ruf=mailto:dmarc.failure@ucalgary.ca;fo=0;adkim=r;aspf=r;pct=100;rf=afrf;ri=21600;sp=none

A

Transport Security

HTTP/3, HSTS, and TLS version analysis

PASS

HTTP/3, HSTS, and TLS version analysis

HTTP/3 (QUIC) not advertised

HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.

HSTS enabled (includeSubDomains)

TLS 1.3 in use (fastest handshake, 1-RTT)