AI Summary
The website has a moderate security posture, scoring 68/100. Several medium and low-severity issues were identified that should be addressed to improve overall security. Addressing these findings will enhance the site's resilience against common web vulnerabilities.
Check Results
HTTPS
⚠WARNINGHTTPS connection succeeded, but HTTP does not redirect to HTTPS.
Security Headers
⚠WARNING5/6 headers are properly configured.
Cookies
✓PASSNo cookies detected.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
✓PASSsecurity.txt is present.
HTTP Methods
✓PASSNo information available.
Findings & Recommendations
HTTP does not redirect to HTTPS
Although HTTPS is supported, the server does not automatically force users from HTTP to HTTPS.
Why it matters: This leaves users vulnerable to man-in-the-middle attacks if they access the site via unencrypted HTTP.
Recommendation: Implement a 301 redirect on the server level to ensure all HTTP traffic is immediately redirected to HTTPS.
Weak Content-Security-Policy configuration
The existing Content-Security-Policy is weakened by including directives like 'unsafe-inline' or wildcards.
Why it matters: Weak policies allow for broader execution of potentially malicious scripts, increasing the risk of XSS attacks.
Recommendation: Review the CSP and remove insecure directives like 'unsafe-inline' and replace wildcards with specific, trusted sources.
Sensitive technical information is exposed
The Server header reveals that the site is running on Cloudflare.
Why it matters: Exposing server software or service information can help attackers target known vulnerabilities specific to that software.
Recommendation: Configure the web server or use appropriate headers to hide or obfuscate the specific server software version.
Strict-Transport-Security
The header is present and properly configured.
X-Content-Type-Options
The header is present and properly configured.
X-Frame-Options
The header is present and properly configured.
Referrer-Policy
The header is present and properly configured.
Permissions-Policy
The header is present and properly configured.
No cookies detected
No Set-Cookie header was found in the response.
security.txt is present
The site publishes a security.txt file.