Scan complete · 3 May 2026
Website Health Check
C
54 / 100
telstra.com
https://www.telstra.com.au/
3.6s scan time
31 checks performed
C
Needs work
HTTPS & TLS
A+100%
All passingSecurity Headers
C52%
Needs workContent Security Policy
F0%
CriticalPermissions Policy
F0%
CriticalServer Security
B78%
Needs workContent Security
C53%
Needs workEmail Security
C62%
Needs workHTTPS & TLS
A+100%
SSL Certificate
Valid SSL certificate from DigiCert Inc - DigiCert EV RSA CA G2, expires in 320 days. Learn more
5/5
TLS 1.2 Support
TLS 1.2 is supported. Learn more
10/10
TLS 1.3 Support
TLS 1.3 is supported (latest version, best performance). Learn more
5/5
TLS 1.0 Disabled
TLS 1.0 is disabled (deprecated protocol correctly rejected). Learn more
5/5
TLS 1.1 Disabled
TLS 1.1 is disabled (deprecated protocol correctly rejected). Learn more
5/5
Security Headers
C52%
Strict-Transport-Security
HSTS configured but missing includeSubDomains. Learn more
10/15
X-Content-Type-Options
X-Content-Type-Options is set to nosniff. Learn more
5/5
X-Frame-Options
X-Frame-Options is set to SAMEORIGIN. Learn more
5/5
Referrer-Policy
Referrer-Policy header is missing. Full URLs may be sent in referrer headers. Learn more
0/5
Cache-Control
Cache-Control is "public, max-age=300, s-maxage=300" but does not include no-store or private. Sensitive pages may be cached. Learn more
1/3
Cross-Origin-Embedder-Policy
Cross-Origin-Embedder-Policy header is missing. Site cannot enable cross-origin isolation. Learn more
0/3
Cross-Origin-Opener-Policy
Cross-Origin-Opener-Policy header is missing. Page may be accessed by cross-origin windows. Learn more
0/3
Cross-Origin-Resource-Policy
Cross-Origin-Resource-Policy header is missing. Resources may be loaded by any origin. Learn more
0/3
CORS Policy
No Access-Control-Allow-Origin header present. Cross-origin requests are restricted by default. Learn more
3/3
Cookie Security
Some cookies missing flags: "cf-viewer-country" missing Secure, HttpOnly, SameSite. Learn more
2/5
Content Security Policy
F0%
Content Security Policy
No Content-Security-Policy header found. The site has no XSS mitigation via CSP. Learn more
0/10
CSP unsafe-inline
No CSP header to check for unsafe-inline. Learn more
0/5
CSP unsafe-eval
No CSP header to check for unsafe-eval. Learn more
0/5
Permissions Policy
F0%
Permissions Policy
No Permissions-Policy or Feature-Policy header found. Browser features like camera, microphone, and geolocation are unrestricted. Learn more
0/10
Server Security
B78%
Server Header Disclosure
Server header shows "TcomCF". Consider removing to reduce information disclosure. Learn more
3/5
Domain Blacklist
Domain is not listed on any of the 3 DNS blacklists checked. Learn more
5/5
Open Redirect
No open redirect vulnerabilities detected via common parameters. Learn more
5/5
Exposed Sensitive Paths
No common admin or sensitive paths are publicly exposed. Learn more
5/5
security.txt
No security.txt file found. Consider adding one for security researchers. Learn more
0/3
Content Security
C53%
Mixed Content
No mixed content detected. All resources use HTTPS. Learn more
5/5
Subresource Integrity
2 of 2 external resources missing SRI: script: https://rum.hlx.page/.rum/@adobe/helix-rum-js@%5E2/dist/rum-standalone.js; script: //assets.adobedtm.com/launch-EN150fea03ccaa40d3b4a005dbafdb143c.min.js. Learn more
0/5
Redirect Chain
2 redirects across 3 domains. Moderate redirect chain. Learn more
3/5
Email Security
C62%
DNSSEC
DNSSEC is not enabled. DNS responses could be spoofed. Learn more
0/3
SPF Record
SPF record found: v=spf1 include:bigpond.com include:_spf.telstra.com.au include:_spf.ssoneweb.telstra.com ~all Learn more
3/3
DMARC Policy
DMARC policy set to "reject" — spoofed emails will be rejected. Learn more
4/4
DKIM Signing
No DKIM records found for common selectors. DKIM may use a custom selector not checked here. Learn more
1/3
Recommendations
- 1highImplement a Content-Security-Policy header with at least default-src and script-src directives.
Show fix
# nginx add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" always; # Apache Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Content-Security-Policy", "value": "default-src 'self'; script-src 'self'" }] }] } - 2highAdd a Strict-Transport-Security header with max-age=31536000 and includeSubDomains.
Show fix
# nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # Apache Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains" }] }] } - 3highSet Secure, HttpOnly, and SameSite flags on all cookies, especially session cookies.
- 4mediumAdd a Permissions-Policy header restricting camera, microphone, geolocation, and payment.
Show fix
# nginx add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always; # Apache Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=(), payment=()" }] }] } - 5mediumSet Referrer-Policy to strict-origin-when-cross-origin or stricter.
Show fix
# nginx add_header Referrer-Policy "strict-origin-when-cross-origin" always; # Apache Header always set Referrer-Policy "strict-origin-when-cross-origin" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }] }] } - 6mediumAdd integrity attributes to external scripts and stylesheets to prevent supply chain attacks.
- 7mediumRemove or hide the Server header to prevent version disclosure.
- 8mediumAdd Cache-Control: no-store or private to prevent sensitive pages from being cached.
Show fix
# nginx add_header Cache-Control "no-store" always; # Apache Header always set Cache-Control "no-store" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Cache-Control", "value": "no-store" }] }] } - 9lowAdd a Cross-Origin-Embedder-Policy header (require-corp or credentialless) to enable cross-origin isolation.
- 10lowAdd a Cross-Origin-Opener-Policy: same-origin header to isolate your browsing context from cross-origin windows.
- 11lowAdd a Cross-Origin-Resource-Policy: same-origin header to prevent your resources from being loaded by other origins.
- 12lowEnable DNSSEC to protect against DNS spoofing attacks.
- 13lowReduce the number of redirects in your URL chain. Excessive redirects slow page loads and may indicate URL obfuscation.
- 14lowConfigure DKIM signing for your email to authenticate outgoing messages.
This scan checks publicly observable security configuration. It does not test for application-level vulnerabilities, perform penetration testing, or access any private data. Results are informational only.