AI Summary
The website has several medium and low-severity security findings that should be addressed to improve its security posture. The score of 63/100 indicates moderate risk, primarily due to configuration weaknesses and minor information exposure. Addressing these items will help harden the site against common web vulnerabilities.
Check Results
HTTPS
⚠WARNINGHTTPS connection succeeded, but HTTP does not redirect to HTTPS.
Security Headers
⚠WARNING5/6 headers are properly configured.
Cookies
✓PASSNo cookies detected.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
⚠WARNINGsecurity.txt was not found.
HTTP Methods
✓PASSAllowed: GET
Findings & Recommendations
HTTP does not redirect to HTTPS
The site allows users to access it via insecure HTTP connections instead of forcing the secure HTTPS protocol.
Why it matters: Using HTTP exposes all transmitted data to eavesdropping and tampering by attackers.
Recommendation: Implement a 301 redirect on the server to automatically send all HTTP traffic to HTTPS.
Weak Content-Security-Policy configuration
While a Content-Security-Policy (CSP) is in place, it contains directives like 'unsafe-inline' or wildcards that reduce its effectiveness.
Why it matters: Weak CSPs allow for greater risk of Cross-Site Scripting (XSS) attacks by permitting less restrictive content sources.
Recommendation: Review the CSP directives and remove 'unsafe-inline', 'unsafe-eval', and overly broad wildcards in favor of specific, trusted sources.
Sensitive technical information is exposed
The server header reveals that the website is running on Cloudflare.
Why it matters: Exposing server information can help attackers fingerprint the technology stack, allowing them to target known vulnerabilities in that specific software.
Recommendation: Configure the web server to suppress or obfuscate the Server header information.
security.txt was not found
The dedicated security.txt file, which provides contact information for security researchers, is missing from the standard location.
Why it matters: This omission discourages responsible disclosure of vulnerabilities by security researchers.
Recommendation: Create a security.txt file at /.well-known/security.txt detailing contact methods for reporting security issues.
Strict-Transport-Security
The header is present and properly configured.
X-Content-Type-Options
The header is present and properly configured.
X-Frame-Options
The header is present and properly configured.
Referrer-Policy
The header is present and properly configured.
Permissions-Policy
The header is present and properly configured.
No cookies detected
No Set-Cookie header was found in the response.