Security
Headers, TLS, exposed files and mixed content.
- minorAdmin Panel Link FoundPage contains links to admin/login panels
- moderateCMS Version ExposedCMS version information is exposed in page source
- moderateCookie Missing HttpOnlyCookie missing HttpOnly flag
- moderateCookie Missing SameSiteCookie missing SameSite attribute
- moderateCORS Allows All OriginsAccess-Control-Allow-Origin is set to wildcard
- criticalCORS Wildcard with CredentialsCORS allows all origins with credentials
- seriousCSP Allows unsafe-evalContent Security Policy allows unsafe-eval
- moderateCSP Allows unsafe-inlineContent Security Policy allows unsafe inline scripts
- seriousCSP Uses Wildcard SourceContent Security Policy uses a wildcard source
- seriousDirectory Listing DetectedPage appears to be an open directory listing
- criticalExposed Sensitive FileA file that should never be public (configuration, source control, a database dump) can be downloaded
- minorExternal Link Missing noopenerExternal links with target=_blank lack rel=noopener
- moderateExternal Script Missing IntegrityExternal script lacks subresource integrity
- criticalForm Submits to HTTPForm action URL uses insecure HTTP
- minorInline Event HandlersPage uses inline JavaScript event handlers
- seriousInsecure CookieCookie missing Secure flag on HTTPS site
- moderateMissing Content Security PolicyMissing Content-Security-Policy header
- seriousMissing HSTS HeaderMissing Strict-Transport-Security header
- minorMissing Permissions PolicyMissing Permissions-Policy header
- minorMissing Referrer PolicyMissing Referrer-Policy header
- minorMissing security.txtNo security.txt tells researchers how to report a vulnerability (RFC 9116)
- moderateMissing X-Content-Type-OptionsMissing X-Content-Type-Options header
- moderateMissing X-Frame-OptionsMissing X-Frame-Options header
- seriousMixed Content (Iframe)HTTPS page loads a iframe over HTTP
- moderateMixed Content (Image)HTTPS page loads a image over HTTP
- criticalMixed Content (Script)HTTPS page loads a script over HTTP
- seriousMixed Content (Stylesheet)HTTPS page loads a stylesheet over HTTP
- criticalNot Using HTTPSPage is served over insecure HTTP
- infoPassword Autocomplete EnabledPassword field allows autocomplete
- seriousSelf-Signed SSL CertificateThe site's TLS certificate is self-signed, so browsers don't trust it
- minorServer Version ExposedServer header reveals version information
- criticalSSL Certificate ExpiredThe site's TLS certificate has expired, so browsers refuse the connection
- seriousSSL Certificate Expiring SoonThe site's TLS certificate expires within 30 days
- seriousSSL Certificate IssueThe site's TLS certificate doesn't validate (wrong name, incomplete chain or untrusted issuer)
- minorX-Powered-By Header PresentX-Powered-By header reveals technology stack