Security (23 rules)
This check area looks at how a website protects connections and visitor data. It covers certificates, TLS and security headers. The report also lists accessible backups or configuration files when the scan finds them. Each finding has an ID and a description of the expected result. Operators can see what is affected and discuss the task with their host or developer. This assessment is not individual security advice.
| ID | Finding when … | Target state | Severity | Fix |
|---|---|---|---|---|
TLS-01 | Certificate and TLS | Certificate valid, host matching, TLS 1.2/1.3 and valid for at least 21 days | Severe | approx. 45 min |
SEC-08 | Confidential paths reachable | Protected paths do not expose confidential content | Severe | approx. 45 min |
PRIV-01 | Cookies/third-party requests | Cookies on first load with Secure/SameSite; third-party requests only observed | Medium | approx. 15 min |
SEC-01 | No strict script CSP | Enforcing, safe script CSP | Medium | approx. 120 min |
SEC-02 | Embedding/base protection missing | Object/base/framing protection | Medium | approx. 15 min |
SEC-03 | nosniff or Referrer-Policy missing | nosniff and Referrer-Policy | Medium | approx. 15 min |
SEC-04 | HSTS too short or missing | HSTS at least one year | Medium | approx. 15 min |
SEC-05 | Character set missing | HTML MIME type and charset | Medium | approx. 15 min |
SEC-06 | Version disclosure | No version disclosure | Minor | approx. 15 min |
SEC-07 | security.txt missing | RFC 9116 security.txt | Medium | approx. 15 min |
SEC-09 | Permissions-Policy or COOP missing | Permissions-Policy and Cross-Origin-Opener-Policy set | Minor | approx. 15 min |
SEC-10 | CORS too open | CORS not with wildcard plus credentials or reflected origin | Severe | approx. 15 min |
SEC-11 | Third-party scripts without integrity protection | Third-party scripts and styles with Subresource Integrity | Medium | approx. 45 min |
SEC-17 | Backup or database dump reachable | No reachable backups, dumps or archives | Severe | approx. 45 min |
SEC-18 | Cookies too long-lived or third-party | Cookies: lifetime below 13 months, no third-party cookies before consent | Medium | approx. 45 min |
SEC-19 | Secret in the source code | No secrets (API keys, tokens, private keys) in the delivered HTML and JavaScript | Severe | approx. 15 min |
PRIV-02 | Personal data in addresses | No personal data in link addresses | Minor | approx. 45 min |
TLS-02 | Outdated TLS versions active | TLS 1.0 and 1.1 disabled | Medium | approx. 15 min |
TLS-05 | Certificate chain incomplete | Certificate chain complete | Medium | approx. 15 min |
TLS-06 | Certificate weak or valid too long | Key at least 2048-bit RSA or 256-bit EC, SHA-2 signature, validity at most 398 days | Medium | approx. 45 min |
TLS-08 | No TLS 1.3 | TLS 1.3 available | Minor | approx. 15 min |
SEC-13 | No CAA record | CAA record restricts certificate issuance | Minor | approx. 15 min |
SEC-14 | SPF or DMARC missing | SPF and DMARC protect the sender domain | Medium | approx. 45 min |