Scan complete · 22 Apr 2026
Website Health Check
C
53 / 100
metrics.com.au
https://www.metrics.com.au/
3.7s scan time
31 checks performed
C
Needs work
HTTPS & TLS
A+100%
All passingSecurity Headers
D38%
CriticalContent Security Policy
F0%
CriticalPermissions Policy
F0%
CriticalServer Security
A87%
All passingContent Security
C53%
Needs workEmail Security
B77%
Needs workHTTPS & TLS
A+100%
TLS 1.2 Support
TLS 1.2 is supported. Learn more
10/10
TLS 1.3 Support
TLS 1.3 is supported (latest version, best performance). Learn more
5/5
TLS 1.0 Disabled
TLS 1.0 is disabled (deprecated protocol correctly rejected). Learn more
5/5
TLS 1.1 Disabled
TLS 1.1 is disabled (deprecated protocol correctly rejected). Learn more
5/5
SSL Certificate
Valid SSL certificate from Google Trust Services - WE1, expires in 80 days. Learn more
5/5
Security Headers
D38%
Strict-Transport-Security
HSTS configured but missing includeSubDomains. Learn more
10/15
X-Content-Type-Options
X-Content-Type-Options header is missing. Browser may MIME-sniff responses. Learn more
0/5
X-Frame-Options
X-Frame-Options header is missing. Page may be embedded in iframes (clickjacking risk). Learn more
0/5
Referrer-Policy
Referrer-Policy header is missing. Full URLs may be sent in referrer headers. Learn more
0/5
Cache-Control
Cache-Control header is missing. Sensitive responses may be cached by intermediaries. Learn more
1/3
Cross-Origin-Embedder-Policy
Cross-Origin-Embedder-Policy header is missing. Site cannot enable cross-origin isolation. Learn more
0/3
Cross-Origin-Opener-Policy
Cross-Origin-Opener-Policy header is missing. Page may be accessed by cross-origin windows. Learn more
0/3
Cross-Origin-Resource-Policy
Cross-Origin-Resource-Policy header is missing. Resources may be loaded by any origin. Learn more
0/3
CORS Policy
No Access-Control-Allow-Origin header present. Cross-origin requests are restricted by default. Learn more
3/3
Cookie Security
All 1 cookie have Secure, HttpOnly, and SameSite flags. Learn more
5/5
Content Security Policy
F0%
Content Security Policy
No Content-Security-Policy header found. The site has no XSS mitigation via CSP. Learn more
0/10
CSP unsafe-inline
No CSP header to check for unsafe-inline. Learn more
0/5
CSP unsafe-eval
No CSP header to check for unsafe-eval. Learn more
0/5
Permissions Policy
F0%
Permissions Policy
No Permissions-Policy or Feature-Policy header found. Browser features like camera, microphone, and geolocation are unrestricted. Learn more
0/10
Server Security
A87%
Server Header Disclosure
Server header shows "cloudflare" (CDN/platform, not a disclosure concern). Learn more
5/5
Domain Blacklist
Domain is not listed on any of the 3 DNS blacklists checked. Learn more
5/5
security.txt
No security.txt file found. Consider adding one for security researchers. Learn more
0/3
Exposed Sensitive Paths
No common admin or sensitive paths are publicly exposed. Learn more
5/5
Open Redirect
No open redirect vulnerabilities detected via common parameters. Learn more
5/5
Content Security
C53%
Mixed Content
No mixed content detected. All resources use HTTPS. Learn more
5/5
Subresource Integrity
14 of 18 external resources missing SRI: script: https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js; script: https://cdn.jsdelivr.net/npm/@finsweet/attributes-selectcustom@1/selectcustom.js; script: https://cdn.jsdelivr.net/npm/@finsweet/attributes-cmsfilter@1/cmsfilter.js (+11 more). Learn more
0/5
Redirect Chain
1 redirect across 2 domains. Moderate redirect chain. Learn more
3/5
Email Security
B77%
SPF Record
SPF record found: v=spf1 ip4:104.210.80.79 include:_spf.qualtrics.com include:spfa.cpmails.com include:spf.protection.... Learn more
3/3
DMARC Policy
DMARC policy set to "reject" — spoofed emails will be rejected. Learn more
4/4
DKIM Signing
DKIM record found for selectors: default, selector1. Learn more
3/3
DNSSEC
DNSSEC is not enabled. DNS responses could be spoofed. Learn more
0/3
Recommendations
- 1highImplement a Content-Security-Policy header with at least default-src and script-src directives.
Show fix
# nginx add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" always; # Apache Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Content-Security-Policy", "value": "default-src 'self'; script-src 'self'" }] }] } - 2highAdd a Strict-Transport-Security header with max-age=31536000 and includeSubDomains.
Show fix
# nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # Apache Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains" }] }] } - 3mediumAdd a Permissions-Policy header restricting camera, microphone, geolocation, and payment.
Show fix
# nginx add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always; # Apache Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=(), payment=()" }] }] } - 4mediumAdd X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking.
Show fix
# nginx add_header X-Frame-Options "DENY" always; # Apache Header always set X-Frame-Options "DENY" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "X-Frame-Options", "value": "DENY" }] }] } - 5mediumSet Referrer-Policy to strict-origin-when-cross-origin or stricter.
Show fix
# nginx add_header Referrer-Policy "strict-origin-when-cross-origin" always; # Apache Header always set Referrer-Policy "strict-origin-when-cross-origin" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }] }] } - 6mediumAdd integrity attributes to external scripts and stylesheets to prevent supply chain attacks.
- 7mediumAdd Cache-Control: no-store or private to prevent sensitive pages from being cached.
Show fix
# nginx add_header Cache-Control "no-store" always; # Apache Header always set Cache-Control "no-store" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Cache-Control", "value": "no-store" }] }] } - 8lowAdd X-Content-Type-Options: nosniff to prevent MIME-sniffing attacks.
Show fix
# nginx add_header X-Content-Type-Options "nosniff" always; # Apache Header always set X-Content-Type-Options "nosniff" # Vercel (vercel.json) { "headers": [{ "source": "/(.*)", "headers": [{ "key": "X-Content-Type-Options", "value": "nosniff" }] }] } - 9lowAdd a Cross-Origin-Embedder-Policy header (require-corp or credentialless) to enable cross-origin isolation.
- 10lowAdd a Cross-Origin-Opener-Policy: same-origin header to isolate your browsing context from cross-origin windows.
- 11lowAdd a Cross-Origin-Resource-Policy: same-origin header to prevent your resources from being loaded by other origins.
- 12lowEnable DNSSEC to protect against DNS spoofing attacks.
- 13lowReduce the number of redirects in your URL chain. Excessive redirects slow page loads and may indicate URL obfuscation.
This scan checks publicly observable security configuration. It does not test for application-level vulnerabilities, perform penetration testing, or access any private data. Results are informational only.