Website Health Check
Scanned 25/03/2026
HTTPS & TLS
A+ (100%)Valid SSL certificate from Let's Encrypt - R12, expires in 51 days. Learn more ↗
TLS 1.2 is supported. Learn more ↗
TLS 1.3 is supported (latest version, best performance). Learn more ↗
TLS 1.0 is disabled (deprecated protocol correctly rejected). Learn more ↗
TLS 1.1 is disabled (deprecated protocol correctly rejected). Learn more ↗
Security Headers
A (82%)HSTS enabled with max-age=63072000, includeSubDomains, preload. Learn more ↗
X-Content-Type-Options is set to nosniff. Learn more ↗
X-Frame-Options is set to DENY. Learn more ↗
Referrer-Policy is set to strict-origin-when-cross-origin. Learn more ↗
Cache-Control is "public, max-age=0, must-revalidate" but does not include no-store or private. Sensitive pages may be cached. Learn more ↗
Cross-Origin-Embedder-Policy is set to credentialless. Learn more ↗
Cross-Origin-Opener-Policy is set to same-origin. Learn more ↗
Cross-Origin-Resource-Policy is set to same-origin. Learn more ↗
Access-Control-Allow-Origin is set to wildcard (*). Any origin can make cross-origin requests. Learn more ↗
No Set-Cookie headers found. Learn more ↗
Content Security Policy
B (75%)CSP is configured with 13 directives. Learn more ↗
CSP allows 'unsafe-inline' which weakens XSS protection. Learn more ↗
CSP does not use unsafe-eval. Learn more ↗
Permissions Policy
C (50%)Permissions-Policy only restricts 4/7 sensitive features. Learn more ↗
Server Security
A (87%)Server header shows "Vercel" (CDN/platform, not a disclosure concern). Learn more ↗
Domain is not listed on any of the 3 DNS blacklists checked. Learn more ↗
No security.txt file found. Consider adding one for security researchers. Learn more ↗
No open redirect vulnerabilities detected via common parameters. Learn more ↗
No common admin or sensitive paths are publicly exposed. Learn more ↗
Content Security
A+ (100%)No mixed content detected. All resources use HTTPS. Learn more ↗
No external scripts or stylesheets found — SRI not needed. Learn more ↗
No redirects detected — URL resolves directly. Learn more ↗
Email Security
D (46%)SPF record found: v=spf1 include:secureserver.net -all Learn more ↗
DMARC policy set to "quarantine" — spoofed emails may be flagged. Consider upgrading to "reject". Learn more ↗
No DKIM records found for common selectors. DKIM may use a custom selector not checked here. Learn more ↗
DNSSEC is not enabled. DNS responses could be spoofed. Learn more ↗
Recommendations
- 1medium{"text":"Add a Permissions-Policy header restricting camera, microphone, geolocation, and payment.","severity":"medium","snippet":"# nginx\nadd_header Permissions-Policy \"camera=(), microphone=(), geolocation=(), payment=()\" always;\n\n# Apache\nHeader always set Permissions-Policy \"camera=(), microphone=(), geolocation=(), payment=()\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"Permissions-Policy\", \"value\": \"camera=(), microphone=(), geolocation=(), payment=()\" }] }] }"}
- 2medium{"text":"Remove 'unsafe-inline' from CSP and use nonces or hashes for inline scripts.","severity":"medium"}
- 3medium{"text":"Add a DMARC record with p=reject at _dmarc.yourdomain.com to block spoofed emails.","severity":"medium"}
- 4medium{"text":"Add Cache-Control: no-store or private to prevent sensitive pages from being cached.","severity":"medium","snippet":"# nginx\nadd_header Cache-Control \"no-store\" always;\n\n# Apache\nHeader always set Cache-Control \"no-store\"\n\n# Vercel (vercel.json)\n{ \"headers\": [{ \"source\": \"/(.*)\", \"headers\": [{ \"key\": \"Cache-Control\", \"value\": \"no-store\" }] }] }"}
- 5medium{"text":"Enable DNSSEC to protect against DNS spoofing attacks.","severity":"low"}
- 6medium{"text":"Restrict Access-Control-Allow-Origin to specific trusted origins instead of using wildcard (*).","severity":"low"}
- 7medium{"text":"Configure DKIM signing for your email to authenticate outgoing messages.","severity":"low"}
This scan checks publicly observable security configuration. It does not test for application-level vulnerabilities, perform penetration testing, or access any private data. Results are informational only.