example.com

fail · TLS·25

The server accepts SSLv3, TLS 1.0 or TLS 1.1 when a client offers nothing newer.

Fix: Disable SSLv3, TLS 1.0 and TLS 1.1 and allow only TLS 1.2 and TLS 1.3.

TLS · RFC 8996guide →

fail · HTTP·34

Port 80 is closed, or plain HTTP requests on it are not redirected to HTTPS.

Fix: Serve HTTP on port 80 and redirect every request to HTTPS with a 301 before serving content.

HTTP · RFC 9110guide →

fail · HTTP·35

HTTPS responses carry no Strict-Transport-Security header, or one with a max-age below one year.

Fix: Send Strict-Transport-Security with max-age=31536000 on all HTTPS responses.

HTTP · RFC 6797guide →

warn · DNS·04

The domain publishes no CAA records, sets issue without issuewild, or uses CAA tags other than issue, issuewild and iodef.

Fix: Publish issue and issuewild CAA records naming the allowed certificate authorities, using only known tags.

DNS · RFC 8659guide →

warn · TLS·26

The server accepts a broken cipher suite (RC4, 3DES, DES, export, NULL or anonymous), or a CBC suite or a static RSA key exchange without forward secrecy.

Fix: Allow only ECDHE suites with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and remove RC4, 3DES, DES, export, NULL, anonymous, CBC and static RSA suites.

TLS · RFC 9325guide →

warn · TLS·33

The domain's HTTPS record advertises no Encrypted Client Hello configuration.

Fix: Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server.

TLS · draft-ietf-tls-esniguide →

warn · HTTP·38

Responses carry no enforced Content-Security-Policy, or one without default-src or with permissive sources such as 'unsafe-inline'.

Fix: Send an enforced Content-Security-Policy with default-src, object-src 'none' and base-uri that restricts scripts to trusted origins.

HTTP · W3C Content Security Policy Level 3guide →

warn · HTTP·39

Responses carry no X-Frame-Options header with the value DENY or SAMEORIGIN.

Fix: Send X-Frame-Options: DENY, or SAMEORIGIN where the site frames its own pages.

HTTP · RFC 7034guide →

warn · HTTP·40

Responses carry no X-Content-Type-Options header with the value nosniff.

Fix: Send X-Content-Type-Options: nosniff on all responses.

HTTP · WHATWG Fetch Standardguide →

warn · HTTP·41

Responses carry no Referrer-Policy header, or one whose effective policy (the last recognised value of a comma-separated list) is origin, origin-when-cross-origin or unsafe-url, or that holds no recognised value or is not readable as text.

Fix: Send Referrer-Policy: strict-origin-when-cross-origin or stricter.

HTTP · W3C Referrer Policyguide →

warn · HTTP·42

Responses carry no Permissions-Policy header.

Fix: Send a Permissions-Policy that disables the browser features the site does not use.

HTTP · W3C Permissions Policyguide →

warn · HTTP·43

Responses carry no Cross-Origin-Opener-Policy header, or one set to unsafe-none, an unrecognised value or a value not readable as text.

Fix: Send Cross-Origin-Opener-Policy: same-origin, or same-origin-allow-popups when the site relies on popups such as payment or login windows.

HTTP · HTML Living Standardguide →

warn · HTTP·45

Responses carry headers that disclose server software or internals, such as Server, X-Powered-By, Via or X-AspNet-Version.

Fix: Remove the Server, X-Powered-By and similar technology headers from the server's responses.

HTTP · RFC 9110guide →

warn · HTTP·46

Responses carry no Cache-Control header, or max-age=0 without no-cache or must-revalidate.

Fix: Send an explicit Cache-Control header on each response and pair max-age=0 with no-cache or must-revalidate.

HTTP · RFC 9111guide →

warn · MAIL·50

The domain's DMARC record is missing, duplicated or invalid, its policy is p=none or p=quarantine, it sets pct=0 or pairs p=reject with sp=none, or its report addresses are missing or unauthorised.

Fix: Publish one DMARC record with p=reject, without sp=none or pct=0, and with an rua address authorised to receive reports.

Email · RFC 7489guide →