Website Health Check
Scanned 23/03/2026
HTTPS & TLS
A+ (100%)TLS 1.2 is supported. Learn more ↗
TLS 1.3 is supported (latest version, best performance). Learn more ↗
TLS 1.0 is disabled (deprecated protocol correctly rejected). Learn more ↗
TLS 1.1 is disabled (deprecated protocol correctly rejected). Learn more ↗
Valid SSL certificate from Let's Encrypt - E8, expires in 73 days. Learn more ↗
Security Headers
F (8%)HSTS header is missing. Browsers may allow HTTP connections. Learn more ↗
X-Content-Type-Options header is missing. Browser may MIME-sniff responses. Learn more ↗
X-Frame-Options header is missing. Page may be embedded in iframes (clickjacking risk). Learn more ↗
Referrer-Policy header is missing. Full URLs may be sent in referrer headers. Learn more ↗
Cache-Control header is missing. Sensitive responses may be cached by intermediaries. Learn more ↗
Cross-Origin-Embedder-Policy header is missing. Site cannot enable cross-origin isolation. Learn more ↗
Cross-Origin-Opener-Policy header is missing. Page may be accessed by cross-origin windows. Learn more ↗
Cross-Origin-Resource-Policy header is missing. Resources may be loaded by any origin. Learn more ↗
No Access-Control-Allow-Origin header present. Cross-origin requests are restricted by default. Learn more ↗
No Set-Cookie headers found. Learn more ↗
Content Security Policy
F (0%)No Content-Security-Policy header found. The site has no XSS mitigation via CSP. Learn more ↗
No CSP header to check for unsafe-inline. Learn more ↗
No CSP header to check for unsafe-eval. Learn more ↗
Permissions Policy
F (0%)No Permissions-Policy or Feature-Policy header found. Browser features like camera, microphone, and geolocation are unrestricted. Learn more ↗
Server Security
A (87%)Server header shows "cloudflare" (CDN/platform, not a disclosure concern). Learn more ↗
Domain is not listed on any of the 3 DNS blacklists checked. Learn more ↗
No open redirect vulnerabilities detected via common parameters. Learn more ↗
Could not check security.txt (request failed). Learn more ↗
No common admin or sensitive paths are publicly exposed. Learn more ↗
Content Security
B (67%)No mixed content detected. All resources use HTTPS. Learn more ↗
7 of 7 external resources missing SRI: script: data:text/javascript;base64,Y29uc3QgbGF6eWxvYWRSdW5PYnNlcnZlcj0oKT0+e2NvbnN0IGxh; script: data:text/javascript;base64,dmFyIE5ldmVQcm9wZXJ0aWVzPXsiYWpheHVybCI6Imh0dHBzOi8v; script: data:text/javascript;base64,dmFyIGh0bWw9ZG9jdW1lbnQuZG9jdW1lbnRFbGVtZW50O3ZhciB0 (+4 more). Learn more ↗
No redirects detected — URL resolves directly. Learn more ↗
Email Security
D (46%)SPF record found: v=spf1 a include:customer.mailguard.com.au include:spf.protection.outlook.com include:spf-c.mailbaby... Learn more ↗
No DMARC record found. The domain has no policy for handling spoofed email. Learn more ↗
DKIM record found for selector: default. Learn more ↗
DNSSEC is not enabled. DNS responses could be spoofed. Learn more ↗
Recommendations
- 1medium{"text":"Add a Strict-Transport-Security header with max-age=31536000 and includeSubDomains.","severity":"high","snippet":"# nginx\nadd_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\n\n# Apache\nHeader always set Strict-Transport-Security \"max-age=31536000; includeSubDomains\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"Strict-Transport-Security\", \"value\": \"max-age=31536000; includeSubDomains\" }] }] }"}
- 2medium{"text":"Implement a Content-Security-Policy header with at least default-src and script-src directives.","severity":"high","snippet":"# nginx\nadd_header Content-Security-Policy \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'\" always;\n\n# Apache\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"Content-Security-Policy\", \"value\": \"default-src 'self'; script-src 'self'\" }] }] }"}
- 3medium{"text":"Add a Permissions-Policy header restricting camera, microphone, geolocation, and payment.","severity":"medium","snippet":"# nginx\nadd_header Permissions-Policy \"camera=(), microphone=(), geolocation=(), payment=()\" always;\n\n# Apache\nHeader always set Permissions-Policy \"camera=(), microphone=(), geolocation=(), payment=()\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"Permissions-Policy\", \"value\": \"camera=(), microphone=(), geolocation=(), payment=()\" }] }] }"}
- 4medium{"text":"Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking.","severity":"medium","snippet":"# nginx\nadd_header X-Frame-Options \"DENY\" always;\n\n# Apache\nHeader always set X-Frame-Options \"DENY\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"X-Frame-Options\", \"value\": \"DENY\" }] }] }"}
- 5medium{"text":"Set Referrer-Policy to strict-origin-when-cross-origin or stricter.","severity":"medium","snippet":"# nginx\nadd_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n\n# Apache\nHeader always set Referrer-Policy \"strict-origin-when-cross-origin\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"Referrer-Policy\", \"value\": \"strict-origin-when-cross-origin\" }] }] }"}
- 6medium{"text":"Add integrity attributes to external scripts and stylesheets to prevent supply chain attacks.","severity":"medium"}
- 7medium{"text":"Add a DMARC record with p=reject at _dmarc.yourdomain.com to block spoofed emails.","severity":"medium"}
- 8medium{"text":"Add Cache-Control: no-store or private to prevent sensitive pages from being cached.","severity":"medium","snippet":"# nginx\nadd_header Cache-Control \"no-store\" always;\n\n# Apache\nHeader always set Cache-Control \"no-store\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"Cache-Control\", \"value\": \"no-store\" }] }] }"}
- 9medium{"text":"Add X-Content-Type-Options: nosniff to prevent MIME-sniffing attacks.","severity":"low","snippet":"# nginx\nadd_header X-Content-Type-Options \"nosniff\" always;\n\n# Apache\nHeader always set X-Content-Type-Options \"nosniff\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"X-Content-Type-Options\", \"value\": \"nosniff\" }] }] }"}
- 10medium{"text":"Add a Cross-Origin-Embedder-Policy header (require-corp or credentialless) to enable cross-origin isolation.","severity":"low"}
- 11medium{"text":"Add a Cross-Origin-Opener-Policy: same-origin header to isolate your browsing context from cross-origin windows.","severity":"low"}
- 12medium{"text":"Add a Cross-Origin-Resource-Policy: same-origin header to prevent your resources from being loaded by other origins.","severity":"low"}
- 13medium{"text":"Enable DNSSEC to protect against DNS spoofing attacks.","severity":"low"}
This scan checks publicly observable security configuration. It does not test for application-level vulnerabilities, perform penetration testing, or access any private data. Results are informational only.