Web & Email Security Test
← Web Test Home
F
Test Information
Targetchaz.nyc
Resolved To:http://chaz.nyc/
IPv4:108.29.9.119
Scan ID #:239
Scan Time (UTC):2022-02-02 23:42:55
Response Code (HTTP):200
Response Code (HTTPS):0
Score:19/115
Tests Passed:19/25
Related Tests
Overall Scores
| Test | Pass | Score | Max | Min | Reason | Recommended Apache Config | More |
|---|---|---|---|---|---|---|---|
| HTTPS Availability | ❌ | -40 | 0 | -40 | Site is not available over HTTPS | — | |
| SSL and TLS Protocols | ➖ | 0 | 0 | -5 | N/A (site not available over HTTPS) | SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | 🛈 |
| HSTS (Strict Transport Security) | ➖ | 0 | 0 | -15 | N/A (Site is not available over HTTPS) | Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload | 🛈 |
| Expect Certificate Transparency | ➖ | 0 | 0 | -5 | N/A (Expect-CT header only effective on HTTPS connections) | — | |
| HTTP Compression | ➖ | 0 | 1 | 0 | Exempt (site not available over HTTPS) | SetEnv no-gzip 1 | 🛈 |
| Cache Control | ➖ | 0 | 0 | -5 | Exempt (site not available over HTTPS) | Header set Cache-Control "no-store, no-cache, must-revalidate" | |
| Cookies | ✅ | 0 | 0 | -20 | N/A (No cookies sent) | — | |
| Subresource Integrity | ✅ | +5 | 5 | -10 | N/A (No external JavaScript detected) | — | 🛈 |
| Content-Security-Policy | ❌ | -24 | 0 | -24 | Content-Security-Policy header not sent | Header set Content-Security-Policy " | 🛈 |
| Feature-Policy | ➖ | 0 | 5 | 0 | Feature-Policy header not sent | Header set Feature-Policy "autoplay 'self';" | |
| Report-To | ➖ | 0 | 1 | 0 | No Report-To header sent | Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true} | |
| Network Error Logging | ➖ | 0 | 1 | 0 | N/A (Requires Report-To header) | Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true} | |
| Referrer Policy | ➖ | 0 | 2 | -5 | Effective Referrer policy is reasonably secure; sensitive data could be leaked to third parties if proper link attributes are not used when needed | Header always set Referrer-Policy "no-referrer-when-downgrade" | |
| X-Content-Type-Options | ✅ | 0 | 0 | -10 | X-Content-Type-Options header securely set | Header set X-Content-Type-Options "nosniff" | |
| X-XSS-Protection | ✅ | 0 | 0 | -10 | X-XSS-Protection header securely set | Header set X-XSS-Protection "1; mode=block" | |
| X-Frame-Options | ✅ | 0 | 0 | -10 | X-Frame-Options header securely set | Header set X-Frame-Options "DENY" | |
| X-Powered-By | ✅ | 0 | 0 | -3 | X-Powered-By header not sent | Header unset "X-Powered-By" | |
| X-AspNet-Version | ✅ | 0 | 0 | -1 | X-AspNet-Version header not sent | — | |
| X-AspNetMvc-Version | ✅ | 0 | 0 | -1 | X-AspNetMvc-Version header not sent | — | |
| Server Header | ❌ | -2 | 0 | -2 | Server header sent, with unnecessarily specific value Apache/2.2.22 (Win32) PHP/5.3.13 | ServerTokens Prod | |
| Cross-Origin Resource Sharing | ✅ | 0 | 0 | -15 | CORS header not implemented | — | |
| DNSSEC (DNS Security Extensions) | ❌ | -5 | 0 | -5 | Domain is not signed with a valid signature | — | |
| IPv6 Reachability | ❌ | -5 | 0 | -5 | Nameservers available via IPv6, but web server is not | — | |
| SPF (Sender Policy Framework) | ✅ | 0 | 0 | -10 | SPF record associated with this domain | — | |
| DMARC (Domain-based Message Authentication, Reporting, and Confidence) | ❌ | -10 | 0 | -10 | An MX record was found for this hostname, but no DMARC record exists | — |
Raw Headers
dateWed, 02 Feb 2022 23:42:53 GMT
serverApache/2.2.22 (Win32) PHP/5.3.13
x-content-type-optionsnosniff
referrer-policystrict-origin-when-cross-origin, no-referrer-when-downgrade
last-modifiedTue, 12 Oct 2021 21:39:16 GMT
etag"10000000127d5-2a09-5ce2ead60ed0c-gzip"
accept-rangesbytes
content-typetext/html
via1.1 dummy.ssl
varyAccept-Encoding
content-encodinggzip
x-frame-optionsSAMEORIGIN
x-xss-protection1; mode=block
transfer-encodingchunked
Test History
Results hidden from public stats are not shown here.
| 2 years ago | 19 |
Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.