AI Summary
The website has a moderate security posture, scoring 60/100. Several headers are misconfigured or missing, and some minor information disclosure risks exist. Addressing the high and medium severity issues should be the immediate priority to improve overall security.
Check Results
HTTPS
✓PASSHTTPS connection succeeded and HTTP redirects to HTTPS.
Security Headers
✕FAIL4/6 headers are properly configured.
Cookies
✓PASSNo cookies detected.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
⚠WARNINGsecurity.txt was not found.
HTTP Methods
✓PASSNo information available.
Findings & Recommendations
Missing Strict-Transport-Security
The Strict-Transport-Security (HSTS) header is not present on the site.
Why it matters: Without HSTS, users might connect to the site over insecure HTTP connections, exposing data.
Recommendation: Implement the Strict-Transport-Security header to force browsers to only connect via HTTPS.
Weak Content-Security-Policy configuration
The existing Content-Security-Policy is weakened by allowing insecure sources like 'unsafe-inline' or 'unsafe-eval'.
Why it matters: Weak CSP allows attackers to inject malicious scripts or resources more easily into the site.
Recommendation: Refine the CSP to remove 'unsafe-inline' and 'unsafe-eval', specifying only trusted sources.
Sensitive technical information is exposed
The Server header reveals that the site is running on Cloudflare.
Why it matters: Exposing server software versions can give attackers knowledge about potential vulnerabilities to target.
Recommendation: Configure the web server to suppress or obscure the specific server software information in HTTP response headers.
security.txt was not found
The /.well-known/security.txt file is missing from the website.
Why it matters: This file is a standard way to provide security contact information to researchers, hindering responsible vulnerability disclosure.
Recommendation: Create and place a security.txt file at /.well-known/security.txt detailing contact information for security reports.
HTTPS is properly configured
The site is reachable over HTTPS and HTTP requests redirect to HTTPS.
X-Content-Type-Options
The header is present and properly configured.
X-Frame-Options
The header is present and properly configured.
Referrer-Policy
The header is present and properly configured.
Permissions-Policy
The header is present and properly configured.
No cookies detected
No Set-Cookie header was found in the response.