AI Summary
The website has a security score of 60/100, indicating several areas for improvement. The most critical issues involve missing security headers that could expose the site to various web vulnerabilities. Addressing these header configurations will significantly improve the site's defensive posture.
Check Results
HTTPS
✓PASSHTTPS connection succeeded and HTTP redirects to HTTPS.
Security Headers
✕FAIL0/6 headers are properly configured.
Cookies
✓PASSNo cookies detected.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
⚠WARNINGsecurity.txt was not found.
HTTP Methods
✓PASSNo information available.
Findings & Recommendations
Missing Content-Security-Policy
The site is not sending a Content-Security-Policy header.
Why it matters: CSP helps prevent various attacks like Cross-Site Scripting (XSS) by controlling which resources the browser loads.
Recommendation: Implement a strict Content-Security-Policy header to whitelist trusted sources for scripts, styles, etc.
Missing Strict-Transport-Security
The Strict-Transport-Security header was not found.
Why it matters: HSTS forces browsers to only connect to the site over HTTPS, preventing protocol downgrade attacks.
Recommendation: Add the Strict-Transport-Security header to instruct browsers to only use HTTPS.
Missing X-Content-Type-Options
The X-Content-Type-Options header was not found.
Why it matters: This header prevents MIME-sniffing by the browser, which can lead to unintended script execution.
Recommendation: Add the X-Content-Type-Options: nosniff header.
Missing X-Frame-Options
The X-Frame-Options header was not found, and the CSP has no frame-ancestors directive either.
Why it matters: This header prevents clickjacking attacks by controlling whether the site can be embedded in an iframe.
Recommendation: Implement the X-Frame-Options: DENY or SAMEORIGIN header.
Missing Referrer-Policy
The Referrer-Policy header was not found.
Why it matters: This controls how much referrer information is included with requests sent from the page to other sites, protecting user privacy.
Recommendation: Set a Referrer-Policy header, such as 'strict-origin-when-cross-origin'.
Missing Permissions-Policy
The Permissions-Policy header was not found.
Why it matters: This header allows developers to explicitly declare which browser features (like geolocation or camera access) are available or disallowed for the page.
Recommendation: Implement a Permissions-Policy header to restrict access to sensitive browser APIs.
Sensitive technical information is exposed
The Server header leaks version information: "Apache/2.4.63 (Ubuntu)".
Why it matters: Exposing server software and version numbers provides attackers with specific targets for known vulnerabilities.
Recommendation: Configure the web server to suppress or generalize the version information in the Server header.
security.txt was not found
The /.well-known/security.txt file is missing, making it harder for security researchers to report issues responsibly.
Why it matters: This file provides a standardized way for security researchers to find contact information for responsible disclosure.
Recommendation: Create and place a security.txt file in the /.well-known/ directory.
HTTPS is properly configured
The site is reachable over HTTPS and HTTP requests redirect to HTTPS.
No cookies detected
No Set-Cookie header was found in the response.