https://bitboinc.athena.org.tr/

Missing Content-Security-Policy

This site does not send a Content-Security-Policy header.

Recommendation: Define a Content-Security-Policy specific to your app, without unnecessary wildcard (*) sources or 'unsafe-inline'.

Missing Strict-Transport-Security

The header was not found.

Recommendation: Configure an appropriate HSTS policy on HTTPS production sites, e.g. 'max-age=31536000; includeSubDomains'.

HTTP does not redirect to HTTPS

The site supports HTTPS, but plain HTTP requests are not automatically redirected to HTTPS.

Recommendation: Add a rule at the server or load-balancer level that redirects all HTTP requests to HTTPS.

Missing X-Content-Type-Options

The header was not found.

Recommendation: Add an 'X-Content-Type-Options: nosniff' header to responses.

Missing X-Frame-Options

The header was not found, and the CSP has no frame-ancestors directive either.

Recommendation: Add an 'X-Frame-Options: DENY' header, or a 'frame-ancestors' directive in your CSP.

Missing Referrer-Policy

The header was not found.

Recommendation: Define a policy such as 'Referrer-Policy: strict-origin-when-cross-origin'.

Missing Permissions-Policy

The header was not found.

Recommendation: Define a Permissions-Policy to restrict unused browser features.

Sensitive technical information is exposed

The Server header is present: "cloudflare" (reveals the software type).

Recommendation: Hide server/framework headers and make sure error messages or debug output are not shown in production.

security.txt was not found

The /.well-known/security.txt file is missing, making it harder for security researchers to report issues responsibly.

Recommendation: Publish a security.txt file in the RFC 9116 format.

No cookies detected

No Set-Cookie header was found in the response.