AI Summary
The security score of 63/100 indicates several areas needing improvement, particularly around transport security and header configuration. While the site has some foundational security measures, addressing these findings will significantly strengthen its overall posture.
Check Results
HTTPS
⚠WARNINGHTTPS connection succeeded, but HTTP does not redirect to HTTPS.
Security Headers
⚠WARNING5/6 headers are properly configured.
Cookies
✓PASSNo cookies detected.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
⚠WARNINGsecurity.txt was not found.
HTTP Methods
✓PASSAllowed: GET
Findings & Recommendations
HTTP does not redirect to HTTPS
The website is accessible via unencrypted HTTP connections, even though HTTPS is supported.
Why it matters: Using HTTP exposes all data transmitted between the user and the server to eavesdropping and tampering.
Recommendation: Implement a permanent 301 redirect from all HTTP traffic to the HTTPS version of the site.
Weak Content-Security-Policy configuration
The current Content-Security-Policy allows overly permissive directives like 'unsafe-inline' or wildcards.
Why it matters: Weak CSP weakens defenses against cross-site scripting (XSS) attacks by allowing potentially malicious content execution.
Recommendation: Review and tighten the CSP directives, removing 'unsafe-inline' and any broad wildcard sources where possible.
Sensitive technical information is exposed
The HTTP response headers reveal the specific software used by the server, in this case, Cloudflare.
Why it matters: Exposing server details can allow attackers to target known vulnerabilities specific to that software version.
Recommendation: Configure the web server or use security headers to suppress or obscure the 'Server' header information.
security.txt was not found
The standard security.txt file, which provides contact information for security researchers, is missing from the expected location.
Why it matters: This omission makes it more difficult for researchers to responsibly report security vulnerabilities.
Recommendation: Create and place a security.txt file in the /.well-known/ directory detailing contact information for security reports.
Strict-Transport-Security
The header is present and properly configured.
X-Content-Type-Options
The header is present and properly configured.
X-Frame-Options
The header is present and properly configured.
Referrer-Policy
The header is present and properly configured.
Permissions-Policy
The header is present and properly configured.
No cookies detected
No Set-Cookie header was found in the response.