AI Summary
The website has a security score of 60/100, indicating several areas where security posture can be improved. There are critical missing security headers that should be addressed immediately. The findings suggest a need for stronger defense-in-depth measures and better information control.
Check Results
HTTPS
✓PASSHTTPS connection succeeded and HTTP redirects to HTTPS.
Security Headers
✕FAIL1/6 headers are properly configured.
Cookies
✓PASSNo cookies detected.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
⚠WARNINGsecurity.txt was not found.
HTTP Methods
✓PASSNo information available.
Findings & Recommendations
Missing Content-Security-Policy
The site does not send a Content-Security-Policy header.
Why it matters: CSP helps mitigate various client-side attacks, such as Cross-Site Scripting (XSS), by controlling which resources the browser is allowed to load.
Recommendation: Implement a strict Content-Security-Policy header to define trusted content sources.
Missing Strict-Transport-Security
The header was not found.
Why it matters: HSTS forces browsers to interact with the site only over HTTPS, preventing downgrade attacks and cookie hijacking.
Recommendation: Add the Strict-Transport-Security header to enforce secure connections.
Missing X-Content-Type-Options
The header was not found.
Why it matters: This header prevents MIME-type sniffing by the browser, which can prevent certain types of content injection attacks.
Recommendation: Add the X-Content-Type-Options header with the value 'nosniff'.
Missing Referrer-Policy
The header was not found.
Why it matters: This policy controls how much referrer information is included with requests sent from the site to other websites, protecting user privacy.
Recommendation: Implement a Referrer-Policy header to control the leakage of referring URLs.
Missing Permissions-Policy
The header was not found.
Why it matters: Permissions Policy allows developers to selectively enable or disable certain browser features for the site, improving security and privacy.
Recommendation: Add a Permissions-Policy header to restrict access to sensitive browser features.
Sensitive technical information is exposed
The Server header leaks version information: "Apache/2.4.58 (Ubuntu)".
Why it matters: Exposing server version details provides attackers with specific information they can use to target known vulnerabilities in that software version.
Recommendation: Configure the web server to suppress or generalize the version information in the Server header.
security.txt was not found
The /.well-known/security.txt file is missing, making it harder for security researchers to report issues responsibly.
Why it matters: This file provides a standardized way for security researchers to find contact information for responsible disclosure of vulnerabilities.
Recommendation: Create and deploy a security.txt file at /.well-known/security.txt.
HTTPS is properly configured
The site is reachable over HTTPS and HTTP requests redirect to HTTPS.
X-Frame-Options
The header is present and properly configured.
No cookies detected
No Set-Cookie header was found in the response.