Scan complete · 17 Apr 2026
Website Health Check
B
70 / 100
monoai.co
https://www.monoai.co/
2.5s scan time
31 checks performed
B
Above average
HTTPS & TLS
A+100%
All passingSecurity Headers
C58%
Needs workContent Security Policy
B75%
Needs workPermissions Policy
F0%
CriticalServer Security
A87%
All passingContent Security
C53%
Needs workEmail Security
C62%
Needs workHTTPS & TLS
A+100%
SSL Certificate
Valid SSL certificate from Google Trust Services - WE1, expires in 66 days. Learn more
5/5
TLS 1.2 Support
TLS 1.2 is supported. Learn more
10/10
TLS 1.3 Support
TLS 1.3 is supported (latest version, best performance). Learn more
5/5
TLS 1.0 Disabled
TLS 1.0 is disabled (deprecated protocol correctly rejected). Learn more
5/5
TLS 1.1 Disabled
TLS 1.1 is disabled (deprecated protocol correctly rejected). Learn more
5/5
Security Headers
C58%
Strict-Transport-Security
HSTS enabled with max-age=31536000, includeSubDomains, preload. Learn more
15/15
X-Content-Type-Options
X-Content-Type-Options header is missing. Browser may MIME-sniff responses. Learn more
0/5
X-Frame-Options
X-Frame-Options is set to SAMEORIGIN. Learn more
5/5
Referrer-Policy
Referrer-Policy header is missing. Full URLs may be sent in referrer headers. Learn more
0/5
Cache-Control
Cache-Control header is missing. Sensitive responses may be cached by intermediaries. Learn more
1/3
Cross-Origin-Embedder-Policy
Cross-Origin-Embedder-Policy header is missing. Site cannot enable cross-origin isolation. Learn more
0/3
Cross-Origin-Opener-Policy
Cross-Origin-Opener-Policy header is missing. Page may be accessed by cross-origin windows. Learn more
0/3
Cross-Origin-Resource-Policy
Cross-Origin-Resource-Policy header is missing. Resources may be loaded by any origin. Learn more
0/3
CORS Policy
No Access-Control-Allow-Origin header present. Cross-origin requests are restricted by default. Learn more
3/3
Cookie Security
All 1 cookie have Secure, HttpOnly, and SameSite flags. Learn more
5/5
Content Security Policy
B75%
Content Security Policy
CSP exists but missing default-src or script-src directive. Learn more
5/10
CSP unsafe-inline
CSP does not use unsafe-inline. Learn more
5/5
CSP unsafe-eval
CSP does not use unsafe-eval. Learn more
5/5
Permissions Policy
F0%
Permissions Policy
No Permissions-Policy or Feature-Policy header found. Browser features like camera, microphone, and geolocation are unrestricted. Learn more
0/10
Server Security
A87%
Server Header Disclosure
Server header shows "cloudflare" (CDN/platform, not a disclosure concern). Learn more
5/5
security.txt
No security.txt file found. Consider adding one for security researchers. Learn more
0/3
Domain Blacklist
Domain is not listed on any of the 3 DNS blacklists checked. Learn more
5/5
Exposed Sensitive Paths
No common admin or sensitive paths are publicly exposed. Learn more
5/5
Open Redirect
No open redirect vulnerabilities detected via common parameters. Learn more
5/5
Content Security
C53%
Mixed Content
No mixed content detected. All resources use HTTPS. Learn more
5/5
Subresource Integrity
7 of 12 external resources missing SRI: script: https://player.vimeo.com/api/player.js; script: https://cdn.prod.website-files.com/gsap/3.14.2/gsap.min.js; script: https://cdn.prod.website-files.com/gsap/3.14.2/SplitText.min.js (+4 more). Learn more
0/5
Redirect Chain
1 redirect across 2 domains. Moderate redirect chain. Learn more
3/5
Email Security
C62%
SPF Record
SPF record found: v=spf1 include:_spf.google.com ~all Learn more
3/3
DMARC Policy
DMARC policy set to "none" — spoofed emails are monitored but not blocked. Consider upgrading to "reject". Learn more
2/4
DKIM Signing
DKIM record found for selector: google. Learn more
3/3
DNSSEC
DNSSEC is not enabled. DNS responses could be spoofed. Learn more
0/3
Recommendations
- 1highImplement a Content-Security-Policy header with at least default-src and script-src directives.
Show fix
# nginx add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" always; # Apache Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Content-Security-Policy", "value": "default-src 'self'; script-src 'self'" }] }] } - 2mediumAdd a Permissions-Policy header restricting camera, microphone, geolocation, and payment.
Show fix
# nginx add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always; # Apache Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=(), payment=()" }] }] } - 3mediumSet Referrer-Policy to strict-origin-when-cross-origin or stricter.
Show fix
# nginx add_header Referrer-Policy "strict-origin-when-cross-origin" always; # Apache Header always set Referrer-Policy "strict-origin-when-cross-origin" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }] }] } - 4mediumAdd integrity attributes to external scripts and stylesheets to prevent supply chain attacks.
- 5mediumAdd a DMARC record with p=reject at _dmarc.yourdomain.com to block spoofed emails.
- 6mediumAdd Cache-Control: no-store or private to prevent sensitive pages from being cached.
Show fix
# nginx add_header Cache-Control "no-store" always; # Apache Header always set Cache-Control "no-store" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Cache-Control", "value": "no-store" }] }] } - 7lowAdd X-Content-Type-Options: nosniff to prevent MIME-sniffing attacks.
Show fix
# nginx add_header X-Content-Type-Options "nosniff" always; # Apache Header always set X-Content-Type-Options "nosniff" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "X-Content-Type-Options", "value": "nosniff" }] }] } - 8lowAdd a Cross-Origin-Embedder-Policy header (require-corp or credentialless) to enable cross-origin isolation.
- 9lowAdd a Cross-Origin-Opener-Policy: same-origin header to isolate your browsing context from cross-origin windows.
- 10lowAdd a Cross-Origin-Resource-Policy: same-origin header to prevent your resources from being loaded by other origins.
- 11lowEnable DNSSEC to protect against DNS spoofing attacks.
- 12lowReduce the number of redirects in your URL chain. Excessive redirects slow page loads and may indicate URL obfuscation.
This scan checks publicly observable security configuration. It does not test for application-level vulnerabilities, perform penetration testing, or access any private data. Results are informational only.