AI Summary
The website has several medium and low-severity security findings that should be addressed to improve its overall security posture. The current score of 63/100 indicates several areas needing attention, particularly around traffic security and header configuration. Addressing these issues will significantly harden the site against potential attacks.
Check Results
HTTPS
⚠WARNINGHTTPS connection succeeded, but HTTP does not redirect to HTTPS.
Security Headers
⚠WARNING5/6 headers are properly configured.
Cookies
✓PASSNo cookies detected.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
⚠WARNINGsecurity.txt was not found.
HTTP Methods
✓PASSAllowed: GET
Findings & Recommendations
HTTP does not redirect to HTTPS
The website allows access via unencrypted HTTP connections instead of forcing users to use HTTPS.
Why it matters: Using HTTP exposes all transmitted data to eavesdropping and potential tampering by attackers.
Recommendation: Configure the web server to automatically redirect all HTTP requests to their HTTPS counterparts.
Weak Content-Security-Policy configuration
The Content-Security-Policy header is present but contains directives that weaken its protective capabilities.
Why it matters: Weak CSP settings can allow attackers to inject malicious scripts or load resources from untrusted sources.
Recommendation: Review and tighten the CSP directives, removing 'unsafe-inline', 'unsafe-eval', and overly permissive wildcards (*).
Sensitive technical information is exposed
The Server header reveals that the site is running on Cloudflare.
Why it matters: Exposing software versions or infrastructure details can give attackers information to target specific vulnerabilities.
Recommendation: Configure the web server or use security headers to hide or obfuscate the Server header information.
security.txt was not found
The standard security.txt file, which provides contact information for security researchers, is missing from the expected location.
Why it matters: This makes it more difficult for security researchers to responsibly report security vulnerabilities found on the site.
Recommendation: Create and deploy a security.txt file at /.well-known/security.txt containing appropriate contact information.
Strict-Transport-Security
The header is present and properly configured.
X-Content-Type-Options
The header is present and properly configured.
X-Frame-Options
The header is present and properly configured.
Referrer-Policy
The header is present and properly configured.
Permissions-Policy
The header is present and properly configured.
No cookies detected
No Set-Cookie header was found in the response.