Website Health Check
Scanned 28/02/2026
HTTPS & TLS
A+ (100%)TLS 1.2 is supported. Learn more ↗
TLS 1.3 is supported (latest version, best performance). Learn more ↗
TLS 1.0 is disabled (deprecated protocol correctly rejected). Learn more ↗
TLS 1.1 is disabled (deprecated protocol correctly rejected). Learn more ↗
Valid SSL certificate from Google Trust Services - WE1, expires in 47 days. Learn more ↗
Security Headers
C (57%)HSTS configured but max-age is 7889238 (recommended: 31536000+), missing includeSubDomains. Learn more ↗
X-Content-Type-Options is set to nosniff. Learn more ↗
X-Frame-Options is set to DENY. Learn more ↗
Referrer-Policy header is missing. Full URLs may be sent in referrer headers. Learn more ↗
Content Security Policy
B (75%)CSP exists but missing default-src or script-src directive. Learn more ↗
CSP does not use unsafe-inline. Learn more ↗
CSP does not use unsafe-eval. Learn more ↗
Permissions Policy
F (0%)No Permissions-Policy or Feature-Policy header found. Browser features like camera, microphone, and geolocation are unrestricted. Learn more ↗
Server Security
B (67%)Server header shows "cloudflare" (CDN/platform, not a disclosure concern). Learn more ↗
Domain is not listed on any of the 3 DNS blacklists checked. Learn more ↗
Critical: /.env is publicly accessible (information disclosure risk). Learn more ↗
Content Security
A (80%)No mixed content detected. All resources use HTTPS. Learn more ↗
1 redirect across 2 domains. Moderate redirect chain. Learn more ↗
Email Security
D (40%)SPF record found: v=spf1 include:spf.protection.outlook.com -all Learn more ↗
No DMARC record found. The domain has no policy for handling spoofed email. Learn more ↗
No DKIM records found for common selectors. DKIM may use a custom selector not checked here. Learn more ↗
Recommendations
- 1mediumAdd a Permissions-Policy header restricting camera, microphone, geolocation, and payment.
- 2mediumSet Referrer-Policy to strict-origin-when-cross-origin or stricter.
- 3mediumRestrict access to admin and sensitive paths using IP allowlists or authentication.
- 4mediumAdd a DMARC record with p=reject at _dmarc.yourdomain.com to block spoofed emails.
- 5mediumAdd a Strict-Transport-Security header with max-age=31536000 and includeSubDomains.
- 6mediumImplement a Content-Security-Policy header with at least default-src and script-src directives.
- 7mediumReduce the number of redirects in your URL chain. Excessive redirects slow page loads and may indicate URL obfuscation.
- 8mediumConfigure DKIM signing for your email to authenticate outgoing messages.
This scan checks publicly observable security configuration. It does not test for application-level vulnerabilities, perform penetration testing, or access any private data. Results are informational only.