netray.info

warn · TLS·18

A certificate in the chain expires within 30 days.

Fix: Renew the certificate now and automate future renewals.

TLS · RFC 5280guide →

warn · TLS·33

The domain's HTTPS record advertises no Encrypted Client Hello configuration.

Fix: Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server.

TLS · draft-ietf-tls-esniguide →

warn · HTTP·36

The site echoes an untrusted request Origin in Access-Control-Allow-Origin, or answers with Access-Control-Allow-Origin: null, together with Access-Control-Allow-Credentials: true, or allows any origin with Access-Control-Allow-Origin: *.

Fix: Allow only an explicit list of trusted origins and send Access-Control-Allow-Credentials only for those.

HTTP · WHATWG Fetch Standardguide →

warn · HTTP·38

Responses carry no enforced Content-Security-Policy, or one without default-src or with permissive sources such as 'unsafe-inline'.

Fix: Send an enforced Content-Security-Policy with default-src, object-src 'none' and base-uri that restricts scripts to trusted origins.

HTTP · W3C Content Security Policy Level 3guide →