AI Summary
The website has a moderate security posture, scoring 73/100. Several medium and low-severity issues were identified across headers, cookies, and information disclosure. Addressing these findings will significantly improve the site's overall security resilience.
Check Results
HTTPS
✓PASSHTTPS connection succeeded and HTTP redirects to HTTPS.
Security Headers
⚠WARNING4/6 headers are properly configured.
Cookies
⚠WARNING3 cookies reviewed.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
✓PASSsecurity.txt is present.
HTTP Methods
✓PASSNo information available.
Findings & Recommendations
Weak Content-Security-Policy configuration
The current Content-Security-Policy header is too permissive.
Why it matters: Allowing unsafe inline scripts or evaluation functions can open the site to Cross-Site Scripting (XSS) attacks.
Recommendation: Review the CSP directives and remove 'unsafe-inline', 'unsafe-eval', or overly broad wildcards (*).
Cookie "_octo" is missing security flags
The cookie named "_octo" is being set without necessary security attributes.
Why it matters: The absence of the HttpOnly flag allows client-side scripts (like JavaScript) to potentially access the cookie, increasing the risk of session hijacking.
Recommendation: Set the HttpOnly flag on the "_octo" cookie to prevent client-side script access.
Missing Permissions-Policy
The Permissions-Policy header is absent from the site's response headers.
Why it matters: This header controls which browser features (like geolocation or camera access) are available to the page and its embedded content, limiting potential attack surfaces.
Recommendation: Implement a Permissions-Policy header to restrict access to powerful browser features.
Sensitive technical information is exposed
The Server HTTP header reveals the specific software version running the site.
Why it matters: Exposing server software details provides attackers with reconnaissance information, helping them target known vulnerabilities in that specific software.
Recommendation: Configure the web server to suppress or generalize the Server header to hide technical details.
HTTPS is properly configured
The site is reachable over HTTPS and HTTP requests redirect to HTTPS.
Strict-Transport-Security
The header is present and properly configured.
X-Content-Type-Options
The header is present and properly configured.
X-Frame-Options
The header is present and properly configured.
Referrer-Policy
The header is present and properly configured.
Cookie "_gh_sess" is configured securely
The Secure, HttpOnly, and SameSite flags are all set correctly.
Cookie "logged_in" is configured securely
The Secure, HttpOnly, and SameSite flags are all set correctly.
security.txt is present
The site publishes a security.txt file.