AI Summary
The website has a moderate security posture, with several high-severity configuration weaknesses present. Immediate attention should be given to strengthening HTTP security headers to mitigate common web vulnerabilities.
Check Results
HTTPS
⚠WARNINGHTTPS connection succeeded, but HTTP does not redirect to HTTPS.
Security Headers
✕FAIL0/6 headers are properly configured.
Cookies
✓PASSNo cookies detected.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
⚠WARNINGsecurity.txt was not found.
HTTP Methods
✓PASSNo information available.
Findings & Recommendations
Missing Content-Security-Policy
The site is not sending a Content-Security-Policy header.
Why it matters: Without this policy, the site is more vulnerable to various injection attacks like Cross-Site Scripting (XSS).
Recommendation: Implement a strict Content-Security-Policy header to control which resources the browser is allowed to load.
Missing Strict-Transport-Security
The Strict-Transport-Security header is absent from the responses.
Why it matters: This header prevents browsers from connecting to the site over insecure HTTP even if users manually type it in.
Recommendation: Add the Strict-Transport-Security header with an appropriate max-age directive.
HTTP does not redirect to HTTPS
The site allows access via plain HTTP connections instead of forcing secure HTTPS connections.
Why it matters: Using HTTP exposes data transmitted between the user and the server to interception.
Recommendation: Configure the web server to automatically redirect all HTTP traffic to HTTPS.
Missing X-Content-Type-Options
The X-Content-Type-Options header is not being sent.
Why it matters: This header helps prevent MIME-type sniffing, which can lead to unexpected content execution.
Recommendation: Add the X-Content-Type-Options header with the value 'nosniff'.
Missing X-Frame-Options
The X-Frame-Options header is missing, and CSP lacks frame-ancestors.
Why it matters: This omission allows the site to potentially be embedded in an iframe on another website, leading to clickjacking attacks.
Recommendation: Implement the X-Frame-Options header (e.g., 'DENY' or 'SAMEORIGIN') or ensure CSP includes a frame-ancestors directive.
Missing Referrer-Policy
The Referrer-Policy header is not present.
Why it matters: Without this, the browser may send sensitive referring page information to external sites.
Recommendation: Implement a Referrer-Policy header (e.g., 'strict-origin-when-cross-origin').
Missing Permissions-Policy
The Permissions-Policy header is not being sent.
Why it matters: This header allows developers to restrict which browser features (like geolocation or camera access) can be used by the site and its embedded content.
Recommendation: Add a Permissions-Policy header to explicitly control browser feature access.
Sensitive technical information is exposed
The Server header reveals that the site is running on Cloudflare.
Why it matters: Exposing server software versions can give attackers information they can use to target known vulnerabilities.
Recommendation: Configure the server or CDN to mask or remove identifying server headers.
security.txt was not found
The /.well-known/security.txt file is missing from the website.
Why it matters: This file provides contact information for security researchers, encouraging responsible vulnerability disclosure.
Recommendation: Create and place a security.txt file in the /.well-known/ directory.
No cookies detected
No Set-Cookie header was found in the response.