AI summary could not be generated: The AI response was not valid JSON.
Check Results
HTTPS
✓PASSHTTPS connection succeeded and HTTP redirects to HTTPS.
Security Headers
✕FAIL0/6 headers are properly configured.
Cookies
⚠WARNING6 cookies reviewed.
Information Disclosure
⚠WARNING1 issue(s) found.
Exposure Checks
⚠WARNINGsecurity.txt was not found.
HTTP Methods
⚠WARNINGAllowed: GET, HEAD, POST, OPTIONS, TRACE
Findings & Recommendations
Missing Content-Security-Policy
This site does not send a Content-Security-Policy header.
Recommendation: Define a Content-Security-Policy specific to your app, without unnecessary wildcard (*) sources or 'unsafe-inline'.
Weak Strict-Transport-Security configuration
The max-age value is too low (recommended: at least 180 days / 15552000 seconds).
Recommendation: Configure an appropriate HSTS policy on HTTPS production sites, e.g. 'max-age=31536000; includeSubDomains'.
Missing X-Content-Type-Options
The header was not found.
Recommendation: Add an 'X-Content-Type-Options: nosniff' header to responses.
Missing X-Frame-Options
The header was not found, and the CSP has no frame-ancestors directive either.
Recommendation: Add an 'X-Frame-Options: DENY' header, or a 'frame-ancestors' directive in your CSP.
Cookie "BAIDUID" is missing security flags
Missing the Secure flag.
Recommendation: Set the cookie with Secure, HttpOnly, and an appropriate SameSite value.
Cookie "BIDUPSID" is missing security flags
Missing the Secure flag.
Recommendation: Set the cookie with Secure, HttpOnly, and an appropriate SameSite value.
Cookie "PSTM" is missing security flags
Missing the Secure flag.
Recommendation: Set the cookie with Secure, HttpOnly, and an appropriate SameSite value.
Cookie "BAIDUID" is missing security flags
Missing the Secure flag.
Recommendation: Set the cookie with Secure, HttpOnly, and an appropriate SameSite value.
Cookie "BDSVRTM" is missing security flags
Missing the Secure flag.
Recommendation: Set the cookie with Secure, HttpOnly, and an appropriate SameSite value.
Cookie "BD_HOME" is missing security flags
Missing the Secure flag.
Recommendation: Set the cookie with Secure, HttpOnly, and an appropriate SameSite value.
Missing Referrer-Policy
The header was not found.
Recommendation: Define a policy such as 'Referrer-Policy: strict-origin-when-cross-origin'.
Missing Permissions-Policy
The header was not found.
Recommendation: Define a Permissions-Policy to restrict unused browser features.
Sensitive technical information is exposed
The Server header leaks version information: "BWS/1.1".
Recommendation: Hide server/framework headers and make sure error messages or debug output are not shown in production.
security.txt was not found
The /.well-known/security.txt file is missing, making it harder for security researchers to report issues responsibly.
Recommendation: Publish a security.txt file in the RFC 9116 format.
A potentially dangerous HTTP method is exposed
The server reports that it allows the TRACE method.
Recommendation: Disable unused HTTP methods in the server configuration.
HTTPS is properly configured
The site is reachable over HTTPS and HTTP requests redirect to HTTPS.