medium · verified
X-Frame-Options header missing
Your site can be embedded in an invisible iframe on another website. Attackers use this technique (called "clickjacking") to trick your users into clicking things without realising it.
medium · verified
X-Content-Type-Options header missing
Browsers can "sniff" your files and treat them as a different file type than intended. This can allow attackers to upload files that get executed as scripts. This header prevents that.
low · verified
Referrer-Policy header missing
When visitors click a link to leave your site, their browser sends your full URL (including any private query parameters) to the destination site. A referrer policy controls what gets shared.
high · verified
Content Security Policy missing
There's no policy controlling what scripts and resources your page can load. Without this, an attacker who injects any code into your page can do anything — steal cookies, redirect users, exfiltrate data.
high · likely
Mixed content — HTTP resources on HTTPS page
Your HTTPS page loads some resources (images, scripts, or styles) over insecure HTTP. Browsers block or warn about this, causing parts of your page to break or display incorrectly for visitors.
low · verified
Missing Permissions-Policy header
Without a Permissions-Policy header, any script on your page can access the camera, microphone, geolocation, and other sensitive browser features. This is a defence-in-depth security header that limits exposure if you get XSS.
medium · verified
No SPF record found
SPF tells email servers which servers are allowed to send email for your domain. Without it, anyone can send email pretending to be you, and your own emails may land in spam.
medium · heuristic
No privacy policy link found
A privacy policy link is legally required in most jurisdictions if you collect any user data. It also builds trust with visitors who want to understand how their data is handled.