{ "domain": "yourdomain.com", "target_url": "https://yourdomain.com/", "scanned_at": "2026-11-07T00:05:13.793Z", "duration_ms": 189, "score": 43, "grade": "F", "summary": { "passed_checks": 8, "total_checks": 17, "https_enforced": true, "ip_address": "192.124.249.6", "status_code": 526, "final_url": "https://yourdomain.com/" }, "raw_headers": [ { "name": "cache-control", "value": "private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0", "isSecurity": false }, { "name": "cf-ray", "value": "a56815c818c5c465-CMH", "isSecurity": false }, { "name": "connection", "value": "close", "isSecurity": false }, { "name": "content-length", "value": "16", "isSecurity": false }, { "name": "content-type", "value": "text/plain; charset=UTF-8", "isSecurity": false }, { "name": "date", "value": "Sat, 07 Nov 2026 00:05:13 GMT", "isSecurity": false }, { "name": "expires", "value": "Thu, 01 Jan 1970 00:00:01 GMT", "isSecurity": false }, { "name": "referrer-policy", "value": "same-origin", "isSecurity": true }, { "name": "server", "value": "cloudflare", "isSecurity": false }, { "name": "x-frame-options", "value": "SAMEORIGIN", "isSecurity": true } ], "checks": { "https_redirect": { "target_https": true, "redirects_to_https": true, "status_code": 301, "destination": "https://yourdomain.com/" }, "headers": [ { "name": "HTTP Strict Transport Security (HSTS)", "header": "Strict-Transport-Security", "present": false, "value": null, "status": "fail", "description": "Enforces secure HTTPS connections and prevents SSL stripping attacks.", "recommendation": "max-age=31536000; includeSubDomains; preload" }, { "name": "Content Security Policy (CSP)", "header": "Content-Security-Policy", "present": false, "value": null, "status": "fail", "description": "Mitigates Cross-Site Scripting (XSS), clickjacking, and unauthorized data injection.", "recommendation": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';" }, { "name": "Anti-Clickjacking (X-Frame-Options)", "header": "X-Frame-Options", "present": true, "value": "SAMEORIGIN", "status": "pass", "description": "Prevents the website from being embedded inside an unauthorized iframe.", "recommendation": "DENY or SAMEORIGIN" }, { "name": "MIME Sniffing Protection", "header": "X-Content-Type-Options", "present": false, "value": null, "status": "fail", "description": "Instructs browsers not to override file MIME types, preventing drive-by script execution.", "recommendation": "nosniff" }, { "name": "Referrer Policy", "header": "Referrer-Policy", "present": true, "value": "same-origin", "status": "pass", "description": "Protects user privacy by controlling how much referrer information is leaked across requests.", "recommendation": "strict-origin-when-cross-origin" }, { "name": "Permissions Policy", "header": "Permissions-Policy", "present": false, "value": null, "status": "warn", "description": "Restricts access to sensitive browser features (camera, microphone, geolocation, sensors).", "recommendation": "camera=(), microphone=(), geolocation=(), payment=()" }, { "name": "Cross-Origin Opener Policy (COOP)", "header": "Cross-Origin-Opener-Policy", "present": false, "value": null, "status": "warn", "description": "Isolates browsing contexts from cross-origin popups, defending against Spectre-style attacks.", "recommendation": "same-origin" } ], "upcoming_headers": [ { "name": "Cross-Origin Embedder Policy (COEP)", "header": "Cross-Origin-Embedder-Policy", "present": false, "value": null, "status": "info", "description": "Allows a site to prevent assets being loaded that do not grant permission via CORS or CORP.", "recommendation": "require-corp or credentialless" }, { "name": "Cross-Origin Resource Policy (CORP)", "header": "Cross-Origin-Resource-Policy", "present": false, "value": null, "status": "info", "description": "Allows a resource owner to specify who can load the resource, preventing speculative data exfiltration.", "recommendation": "same-origin or same-site" }, { "name": "Reporting API Endpoints", "header": "Report-To", "present": false, "value": null, "status": "info", "description": "Collects browser telemetry for CSP violations, COOP/COEP isolation reports, and network error logs.", "recommendation": "Configure Reporting-Endpoints for passive telemetry" } ], "leaks": [ { "header": "server", "exposed": true, "value": "cloudflare", "severity": "low", "description": "Exposes software stack name (cloudflare). Stripping or obscuring this header is recommended." }, { "header": "x-powered-by", "exposed": false, "value": null, "severity": "low", "description": "Header is properly stripped or not emitted." }, { "header": "x-aspnet-version", "exposed": false, "value": null, "severity": "low", "description": "Header is properly stripped or not emitted." }, { "header": "x-generator", "exposed": false, "value": null, "severity": "low", "description": "Header is properly stripped or not emitted." } ], "cookies": [], "dns": [ { "type": "SPF", "present": true, "record": "v=spf1 include:dc-aa8e722993._spfm.yourdomain.com ~all", "status": "pass", "description": "Sender Policy Framework record is active to prevent email spoofing." }, { "type": "DMARC", "present": true, "record": "v=DMARC1; p=none; rua=mailto:mailto:prashant@yourdomain.com", "status": "pass", "description": "DMARC policy is deployed for domain message authentication reporting and conformance." }, { "type": "CAA", "present": false, "record": null, "status": "warn", "description": "No CAA record found. Any public Certificate Authority can issue SSL certificates for this domain." } ], "files": [ { "path": "/.well-known/security.txt", "present": false, "status": "warn", "description": "No security.txt found. White-hat security researchers have no defined disclosure contact." }, { "path": "/robots.txt", "present": false, "status": "neutral", "description": "No robots.txt found." } ] }, "remediation": { "Strict-Transport-Security": { "title": "HSTS (HTTP Strict Transport Security)", "nginx": "add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" always;", "apache": "Header always set Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"", "caddy": "header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"", "astro": "# public/_headers\n/*\n Strict-Transport-Security: max-age=31536000; includeSubDomains; preload" }, "Content-Security-Policy": { "title": "Content Security Policy (CSP)", "nginx": "add_header Content-Security-Policy \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none';\" always;", "apache": "Header always set Content-Security-Policy \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none';\"", "caddy": "header Content-Security-Policy \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none';\"", "astro": "# public/_headers\n/*\n Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;" }, "X-Content-Type-Options": { "title": "X-Content-Type-Options", "nginx": "add_header X-Content-Type-Options \"nosniff\" always;", "apache": "Header always set X-Content-Type-Options \"nosniff\"", "caddy": "header X-Content-Type-Options \"nosniff\"", "astro": "# public/_headers\n/*\n X-Content-Type-Options: nosniff" }, "Permissions-Policy": { "title": "Permissions-Policy", "nginx": "add_header Permissions-Policy \"camera=(), microphone=(), geolocation=(), payment=()\" always;", "apache": "Header always set Permissions-Policy \"camera=(), microphone=(), geolocation=(), payment=()\"", "caddy": "header Permissions-Policy \"camera=(), microphone=(), geolocation=(), payment=()\"", "astro": "# public/_headers\n/*\n Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()" }, "Cross-Origin-Opener-Policy": { "title": "Cross-Origin-Opener-Policy (COOP)", "nginx": "add_header Cross-Origin-Opener-Policy \"same-origin\" always;", "apache": "Header always set Cross-Origin-Opener-Policy \"same-origin\"", "caddy": "header Cross-Origin-Opener-Policy \"same-origin\"", "astro": "# public/_headers\n/*\n Cross-Origin-Opener-Policy: same-origin" }, "server-leaks": { "title": "Strip Information Disclosure Headers", "nginx": "server_tokens off;\nmore_clear_headers Server X-Powered-By X-AspNet-Version X-Generator;", "apache": "ServerTokens Prod\nServerSignature Off\nHeader unset X-Powered-By\nHeader unset X-AspNet-Version", "caddy": "header -Server\nheader -X-Powered-By\nheader -X-AspNet-Version\nheader -X-Generator", "astro": "# Astro does not emit X-Powered-By by default.\n# In edge deployments, remove them via _headers or middleware." }, "caa": { "title": "Set Certificate Authority Authorization (CAA) Records", "nginx": "# DNS record configured at your domain name registrar or DNS provider", "apache": "# DNS record configured at your domain name registrar or DNS provider", "caddy": "# Add CAA DNS record in your DNS control panel:\n# Type: CAA, Name: @, Tag: issue, Value: \"letsencrypt.org\"", "astro": "# DNS record configured at your domain name registrar or DNS provider" }, "security.txt": { "title": "Publish /.well-known/security.txt", "nginx": "location = /.well-known/security.txt {\n default_type text/plain;\n}", "apache": "\n ForceType text/plain\n", "caddy": "handle /.well-known/security.txt {\n respond \"Contact: mailto:security@example.com\\nExpires: 2027-12-31T23:59:59.000Z\"\n}", "astro": "# In Astro, create public/.well-known/security.txt:\nContact: mailto:security@example.com\nExpires: 2027-12-31T23:59:59.000Z" } } }