netray.info · http

run of 2026-11-06 01:33 UTC entry WjP1e44d

Port 80 redirects Port 80 probe Response headers HSTS
warn HTTP·36

warn · HTTP·36

CORS policy

Allows any origin (Access-Control-Allow-Origin: *)

Fix: Allow only an explicit list of trusted origins and send Access-Control-Allow-Credentials only for those.

HTTP · WHATWG Fetch Standardevidence →guide →

CORS
untested HTTP·37

untested · HTTP·37

Secure cookies

not applicable

HTTP · RFC 6265evidence →guide →

Cookies
warn HTTP·38

warn · HTTP·38

Content Security Policy

style-src contains 'unsafe-inline'

Fix: Send an enforced Content-Security-Policy with default-src, object-src 'none' and base-uri that restricts scripts to trusted origins.

HTTP · W3C Content Security Policy Level 3evidence →guide →

Response headers Content Security Policy Response headers
pass HTTP·40

pass · HTTP·40

X-Content-Type-Options

HTTP · WHATWG Fetch Standardevidence →guide →

Response headers Response headers Response headers
pass HTTP·43

pass · HTTP·43

Cross-Origin-Opener-Policy

HTTP · HTML Living Standardevidence →guide →

Response headers Cross-origin isolation
pass HTTP·44

pass · HTTP·44

Deprecated headers

HTTP · OWASP Secure Headers Projectevidence →guide →

Response headers Response headers Response headers Caching

Redirects

Nothing recorded.

Port 80 redirects

Feeds lines: Redirect

Port 80 probe

url
http://netray.info/
status_code
200
redirects_to_https
yes

Feeds lines: Redirect

Response headers

namevalue
access-control-allow-origin*
cache-controlno-cache
content-encodinggzip
content-security-policydefault-src 'self'; script-src 'self' 'sha256-FBZufGszYN+NT1Qfwwcpw8g3UwIyffzP+zXtvQP53zc='; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; connect-src 'self' https://stats.uptimerobot.com; frame-ancestors 'none'; base-uri 'self'; object-src 'none'; form-action 'self' https://netray.info https://*.netray.info
content-typetext/html; charset=utf-8
cross-origin-opener-policysame-origin
cross-origin-resource-policycross-origin
dateFri, 06 Nov 2026 01:33:18 GMT
permissions-policycamera=(), microphone=(), geolocation=(), payment=()
referrer-policystrict-origin-when-cross-origin
strict-transport-securitymax-age=31536000; includeSubDomains; preload
varyaccept-encoding, origin, access-control-request-method, access-control-request-headers
x-content-type-optionsnosniff
x-frame-optionsDENY
x-request-id01a1ae7d-1fa5-727e-ab39-1ba31b0ef202

Feeds lines: HSTS, CSP, XFO, XCTO, Referrer, Perms, COOP, Legacy, Leakage, Caching

Content-Security-Policy

Enforced

1 issue

default-src'self'
script-src'self' 'sha256-FBZufGszYN+NT1Qfwwcpw8g3UwIyffzP+zXtvQP53zc='
style-src'self' 'unsafe-inline'
  • style-src contains 'unsafe-inline'
font-src'self'
img-src'self' data:
connect-src'self' https://stats.uptimerobot.com
frame-ancestors'none'
base-uri'self'
object-src'none'
form-action'self' https://netray.info https://*.netray.info

Feeds lines: CSP

Strict-Transport-Security

max-age1 year (31536000 s)
includeSubDomainsyes
preloadyes

Feeds lines: HSTS

Caching

Cache-Controlno-cache
max-agenot set
ETagnot set
Last-Modifiednot set
Varyaccept-encodingoriginaccess-control-request-methodaccess-control-request-headers
Agenot set

Feeds lines: Caching

Cross-origin isolation

Cross-Origin-Opener-Policysame-origin
Cross-Origin-Embedder-Policymissing
Cross-Origin-Resource-Policycross-origin, present

COEP and CORP are not part of the grade.

Feeds lines: COOP

Server

Final URLhttps://netray.info/
Status200
HTTP versionh2
OrganisationOracle Corporation
Network typecloud

Inspection took 444 ms

CORS

allows_any_origin
yes
reflects_origin
no
allows_credentials
no
allow_origin
*

Feeds lines: CORS

Cookies

Nothing recorded.

Feeds lines: Cookies

Explore live

Evidence view

The checks of one protocol in a stored run and the evidence they read. Copy or download this protocol's checks and evidence.

Keyboard

rCheck the domain again
j / kNext or previous check
?Open this help
EscClose this help

How the grade is scored →