Website report card

HTTP/2 200 · 10 headers · open the full security headers tool

• Medium

  HSTS max-age is 183 days

  Reasonable, but below the one year (31536000) the preload list requires.

  Fix Send HSTS for one year on HTTPS responses. Add includeSubDomains only once every subdomain serves HTTPS.

  Show nginx · Apache · Cloudflare

  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

  SSL/TLS > Edge Certificates > HTTP Strict Transport Security (HSTS)
  Enable, Max Age 12 months, include subdomains if every subdomain is HTTPS

• Medium

  Referrer-Policy is not set

  Current Chrome, Firefox and Safari default to strict-origin-when-cross-origin, which is sensible. Setting it explicitly makes the behaviour the same in every browser.

  Fix Send only the origin to other sites, never the full URL.

  Show nginx · Apache · Cloudflare

  add_header Referrer-Policy "strict-origin-when-cross-origin" always;

  Header always set Referrer-Policy "strict-origin-when-cross-origin"

  Rules > Transform Rules > Modify Response Header
  Set static  Referrer-Policy
  Value       strict-origin-when-cross-origin

• Medium

  Permissions-Policy is missing

  Optional, but a short policy such as camera=(), microphone=(), geolocation=() stops embedded third-party content from asking for those permissions.

  Fix Switch off browser features the site does not use. List any feature you do use as, for example, geolocation=(self).

  Show nginx · Apache · Cloudflare

  add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"

  Rules > Transform Rules > Modify Response Header
  Set static  Permissions-Policy
  Value       camera=(), microphone=(), geolocation=(), payment=()

• Medium

  Server header reveals a version: nginx/1.24.0

  A version number tells an attacker which known vulnerabilities to try. Most servers can be told to omit it (nginx: server_tokens off).

  Fix Hide the version number.

  Show nginx · Apache · Cloudflare

  server_tokens off;   # in the http block

  ServerTokens Prod
  ServerSignature Off

  Rules > Transform Rules > Modify Response Header
  Remove  Server

• Medium

  x-powered-by: PHP/8.2.12

  Advertises the software stack for no benefit to visitors. Remove it.

  Fix Stop advertising the application stack. For PHP, expose_php = Off in php.ini removes it at the source.

  Show nginx · Apache · Cloudflare

  fastcgi_hide_header X-Powered-By;   # PHP-FPM
  proxy_hide_header X-Powered-By;     # reverse proxy

  Header always unset X-Powered-By

  Rules > Transform Rules > Modify Response Header
  Remove  X-Powered-By

• Medium

  Cookie session lacks Secure, SameSite

  Secure keeps it off plain HTTP; HttpOnly hides it from JavaScript (omit only if scripts must read it); SameSite limits cross-site sending (Chromium defaults to Lax when absent).

  Fix Set the missing attributes where the cookie is created. The server-level lines add them to every cookie the backend sets.

  Show App · nginx · Apache

  Set-Cookie: session=...; Path=/; Secure; HttpOnly; SameSite=Lax

  proxy_cookie_flags ~ secure httponly samesite=lax;   # nginx 1.19.3+

  Header always edit Set-Cookie ^(.*)$ "$1; Secure; HttpOnly; SameSite=Lax"

Content-Security-Policy header · 3 directives · open the full content-security-policy tool

• High

  script-src: 'unsafe-inline' allows inline script

  Any injected <script> block or onclick= attribute runs, which is exactly what CSP exists to prevent. Replace it with nonces or hashes.

  Fix Give each inline script a per-response nonce and drop 'unsafe-inline'. The application has to generate the nonce; a static web server cannot.

  Show CSP · HTML

  script-src 'nonce-{random per response}' 'strict-dynamic';

  <script nonce="{same random value}">...</script>

• Medium

  object-src is 'self' (from default-src)

  Recommended value is 'none'. It costs nothing on a modern site.

  Fix Add object-src 'none'. Nothing on a current site needs <object> or <embed>.

  Show CSP

  object-src 'none';

• Medium

  No base-uri

  base-uri does not fall back to default-src. Without it, an injected <base href> tag can redirect every relative script URL on the page to an attacker's host, bypassing nonce-based policies. Set base-uri 'none' or 'self'.

  Fix Add base-uri 'self' (or 'none' if the site has no <base> tag).

  Show CSP

  base-uri 'self';

• Note

  script-src: host allowlist (1 host)

  Allowlists are often bypassable: if any listed host serves JSONP endpoints, user uploads or an old copy of AngularJS, an attacker can run script from it. Nonces with 'strict-dynamic' avoid the problem.

• Note

  No frame-ancestors

  Other sites may embed this page in a frame (clickjacking risk) unless X-Frame-Options is set. frame-ancestors 'self' or 'none' is the modern replacement for X-Frame-Options.

  Fix Add frame-ancestors 'self' to control who can frame the page.

  Show CSP

  frame-ancestors 'self';

• Note

  No form-action

  form-action does not fall back to default-src, so an injected form could post to any host. form-action 'self' is a cheap addition if all forms submit to your own site.

  Fix Add form-action 'self' if every form on the site submits to the site itself.

  Show CSP

  form-action 'self';

• Note

  No reporting endpoint

  Without report-uri or report-to you will not hear about violations, including ones that break your own pages.

  Fix Add a report-uri (or report-to) endpoint to hear about violations. Any URL that accepts a POST will do; report collection services give you one.

  Show CSP

  report-uri /csp-report;

3 TXT records: SPF, DMARC, DKIM · open the full email authentication tool

• Medium

  DMARC: p=none: monitoring only

  Mail that fails DMARC is still delivered normally. That is the right first step while you read reports; move to quarantine, then reject, once legitimate senders all pass. Google and Yahoo require at least p=none from bulk senders.

  Fix Once the reports show every legitimate sender passing, move to quarantine, then reject.

  Show DNS

  _dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

• Medium

  DKIM: RSA key of 1024 bits

  1024-bit keys still verify, but RFC 8301 recommends 2048 bits for signers, and 1024-bit RSA is within reach of well-funded attackers. Rotate to 2048.

  Fix Generate a 2048-bit key under a new selector in your mail provider's settings, publish it, switch signing to it, then retire the old selector.

• Note

  SPF: 2 DNS-querying terms at the top level

  Each include: pulls in another record whose own lookups count toward the same limit of 10, and this tool cannot see inside them. Check the total with the record of each included domain.

robots.txt · 3 groups · open the full crawlability tool

• Note

  Blocks GPTBot

  These are AI crawlers, not search engines, so blocking them does not affect search ranking. It is a choice, not an error.

• Note

  Line 15: crawl-delay: 10

  Not part of RFC 9309. Bing and Yandex honour it; Google ignores it.

10 meta tags, 1 link tags · open the full meta and social tags tool

• High

  og:image is not an absolute URL

  "/images/share-card.jpg" — crawlers fetch the image directly and do not resolve relative paths. Use the full https:// URL.

  Fix Use the image's full https:// URL.

  Show HTML

  <meta property="og:image" content="https://www.example.com/share-card.png">

• Medium

  Title is 86 characters

  Google cuts titles by pixel width (about 600px), which is typically 50–60 characters; the rest becomes "…". Put the words that matter first.

  Fix Shorten the title to about 60 characters and put the important words first.

• Note

  No og:image:width / og:image:height

  Optional, but declaring them lets some platforms render the card on the first share instead of after fetching the image.

• Note

  No og:image:alt

  Alt text for the preview image, read by screen readers on platforms that support it.