AI Summary
The security score of 46/100 indicates several significant vulnerabilities that require immediate attention. The findings highlight issues across headers, cookies, and basic protocol enforcement. Addressing these items will substantially improve the website's security posture.
Check Results
HTTPS
⚠WARNINGHTTPS connection succeeded, but HTTP does not redirect to HTTPS.
Security Headers
✕FAIL1/6 headers are properly configured.
Cookies
⚠WARNING3 cookies reviewed.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
✓PASSsecurity.txt is present.
HTTP Methods
✓PASSNo information available.
Findings & Recommendations
Missing Content-Security-Policy
The site is not sending a Content-Security-Policy header.
Why it matters: Without this policy, the site is more susceptible to various injection attacks like Cross-Site Scripting (XSS).
Recommendation: Implement a strict Content-Security-Policy header to control which resources the browser is allowed to load.
Missing Strict-Transport-Security
The Strict-Transport-Security header is absent from the response.
Why it matters: This header prevents users from accidentally connecting to the site over insecure HTTP connections, even if they type the wrong URL.
Recommendation: Add a Strict-Transport-Security header with an appropriate max-age directive.
HTTP does not redirect to HTTPS
The website allows access via unencrypted HTTP connections.
Why it matters: Data transmitted over HTTP is vulnerable to eavesdropping and man-in-the-middle attacks.
Recommendation: Implement a 301 redirect on all HTTP traffic to the HTTPS version of the site.
Missing X-Content-Type-Options
The X-Content-Type-Options header is not being sent.
Why it matters: This header helps prevent MIME-sniffing attacks by telling the browser to only accept the declared content type.
Recommendation: Add the X-Content-Type-Options header with the value 'nosniff'.
Cookie "__Secure-STRP" is missing security flags
Missing the HttpOnly flag.
Recommendation: Set the cookie with Secure, HttpOnly, and an appropriate SameSite value.
Cookie "NID" is missing security flags
The cookie named "NID" is missing the Secure flag.
Why it matters: Without the Secure flag, the cookie may be transmitted over unencrypted HTTP connections, exposing it to interception.
Recommendation: Set the Secure attribute for the "NID" cookie.
Missing Referrer-Policy
The Referrer-Policy header is not present.
Why it matters: This controls how much referrer information is included with requests made from the site to other sites, protecting user privacy.
Recommendation: Implement a Referrer-Policy header, such as 'no-referrer-when-downgrade'.
Missing Permissions-Policy
The Permissions-Policy header is not being sent.
Why it matters: This header allows developers to selectively enable or disable certain browser features for the site, reducing the attack surface.
Recommendation: Implement a Permissions-Policy header to restrict access to powerful browser features.
Sensitive technical information is exposed
The Server header reveals the software type ("gws").
Why it matters: Exposing server software versions allows attackers to target known vulnerabilities in that specific software.
Recommendation: Configure the web server to suppress or obfuscate the Server header.
X-Frame-Options
The header is present and properly configured.
Cookie "AEC" is configured securely
The Secure, HttpOnly, and SameSite flags are all set correctly.
security.txt is present
The site publishes a security.txt file.