Web & Email Security Test
← Web Test Home
A
Test Information
Targetcordmail.xyz
Resolved To:https://www.cordmail.xyz/
IPv4:38.85.252.113
Scan ID #:333
Scan Time (UTC):2022-09-28 11:42:29
Response Code (HTTP):301
Response Code (HTTPS):200
Score:93/120
Tests Passed:22/25
Related Tests
Overall Scores
| Test | Pass | Score | Max | Min | Reason | Recommended Apache Config | More |
|---|---|---|---|---|---|---|---|
| HTTPS Availability | ✅ | 0 | 0 | -40 | Site is available over HTTPS and HTTP redirects to HTTPS with same hostname | — | |
| SSL and TLS Protocols | ➖ | 0 | 5 | -20 | TLS v1.3 is supported but TLS v1.2 is not supported. Most clients aren't TLS 1.3 capable yet, so you should still support TLS 1.2 for now. | SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | 🛈 |
| HSTS (Strict Transport Security) | ➖ | -5 | 0 | -15 | Max-age (365 days) is at least 1 year, but subdomains not included | Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload | 🛈 |
| Expect Certificate Transparency | ❌ | -5 | 0 | -5 | Site available over HTTPS but no certificate transparency directives | — | |
| HTTP Compression | ✅ | +1 | 1 | 0 | Content-Encoding header not sent | SetEnv no-gzip 1 | 🛈 |
| Cache Control | ✅ | 0 | 0 | -5 | Cache-Control directives prevent caching | Header set Cache-Control "no-store, no-cache, must-revalidate" | |
| Cookies | ✅ | 0 | 0 | -20 | N/A (No cookies sent) | — | |
| Subresource Integrity | ✅ | +5 | 5 | -10 | N/A (No external JavaScript detected) | — | 🛈 |
| Content-Security-Policy | ❌ | -4 | 0 | -24 | Content-Security-Policy header sent (see subtable for details) | Header set Content-Security-Policy " | 🛈 |
| Feature-Policy | ✅ | +5 | 5 | 0 | Feature-Policy header sent | Header set Feature-Policy "autoplay 'self';" | |
| Report-To | ✅ | +1 | 1 | 0 | Report-To header sent | Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true} | |
| Network Error Logging | ➖ | 0 | 1 | 0 | No NEL header sent | Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true} | |
| Referrer Policy | ➖ | 0 | 2 | -5 | Effective Referrer policy is reasonably secure; sensitive data could be leaked to third parties if proper link attributes are not used when needed | Header always set Referrer-Policy "no-referrer-when-downgrade" | |
| X-Content-Type-Options | ✅ | 0 | 0 | -10 | X-Content-Type-Options header securely set | Header set X-Content-Type-Options "nosniff" | |
| X-XSS-Protection | ✅ | 0 | 0 | -10 | X-XSS-Protection header securely set | Header set X-XSS-Protection "1; mode=block" | |
| X-Frame-Options | ✅ | 0 | 0 | -10 | X-Frame-Options header securely set | Header set X-Frame-Options "DENY" | |
| X-Powered-By | ✅ | 0 | 0 | -3 | X-Powered-By header not sent | Header unset "X-Powered-By" | |
| X-AspNet-Version | ✅ | 0 | 0 | -1 | X-AspNet-Version header not sent | — | |
| X-AspNetMvc-Version | ✅ | 0 | 0 | -1 | X-AspNetMvc-Version header not sent | — | |
| Server Header | ✅ | 0 | 0 | -2 | Server header sent, with general, non-specific value Apache | ServerTokens Prod | |
| Cross-Origin Resource Sharing | ✅ | 0 | 0 | -15 | CORS header not implemented | — | |
| DNSSEC (DNS Security Extensions) | ❌ | -5 | 0 | -5 | Domain is not signed with a valid signature | — | |
| IPv6 Reachability | ➖ | 0 | 0 | -5 | Nameservers not available via IPv6, so site can't support IPv6 | — | |
| SPF (Sender Policy Framework) | ➖ | 0 | 0 | -10 | No MX records associated with this hostname | — | |
| DMARC (Domain-based Message Authentication, Reporting, and Confidence) | ➖ | 0 | 0 | -10 | No MX records associated with this hostname | — |
Content Security Policy
| Directive | Pass | Score | Max | Min | Reason | Current | Recommended Baseline | More |
|---|---|---|---|---|---|---|---|---|
| default-src | ❌ | -1 | 0 | -1 | Default policy too permissive | ' | 'none' | |
| script-src | ➖ | 0 | 0 | -4 | JavaScript sources restricted but potentially permissively | ' | 'self' | |
| style-src | ➖ | 0 | 0 | -4 | CSS sources restricted but potentially permissively | ' | 'self' | |
| font-src | ➖ | 0 | 0 | -2 | Font sources restricted but potentially permissively | ' | 'self' | 🛈 |
| base-uri | ❌ | -1 | 0 | -1 | Use of the <base> tag should be restricted | ' | 'none' | |
| frame-ancestors | ❌ | -1 | 0 | -3 | Site vulnerable to clickjacking attacks | ' | 'none' | |
| form-action | ➖ | 0 | 0 | 0 | Missing, but this directive may not be appropriate | 🛈 | ||
| plugin-types | ✅ | 0 | 0 | 0 | CSP doesn't contain deprecated directive | application/pdf | ||
| object-src | ➖ | 0 | 0 | -1 | <object>, <embed>, and <applet> sources restricted but potentially permissively | ' | 'none' | |
| child-src | ➖ | 0 | 0 | -1 | Web workers and nested browsing contexts sources restricted but potentially permissively | ' | 'none' | |
| frame-src | ➖ | 0 | 0 | -1 | Frames restricted but potentially permissively | ' | 'none' | |
| img-src | ➖ | 0 | 0 | -1 | All HTTPS images allowed. | https: data: | https: data: | |
| worker-src | ➖ | 0 | 0 | -1 | Worker, SharedWorker, and ServiceWorker scripts restricted but potentially permissively | ' | 'none' | |
| manifest-src | ➖ | 0 | 0 | -1 | Manifest sources restricted but potentially permissively | ' | 'none' | |
| media-src | ➖ | 0 | 0 | -1 | Media sources restricted but potentially permissively | ' | 'self' | |
| connect-src | ➖ | 0 | 0 | -1 | Script interface URL (e.g. XHR, WS) sources restricted but potentially permissively | ' | 'self' | 🛈 |
| report-uri | ✅ | 0 | 0 | -1 | Needed for CSP reporting in CSP version 2 | https://17f7736b07193242e5718c530104cdfa.report-uri.com/r/d/csp/enforce | https://<your-endpoint>.report-uri.com/r/d/csp/enforce | |
| report-to | ➖ | -1 | 0 | 0 | Needed for CSP reporting in CSP version 3 | default |
Raw Headers
dateWed, 28 Sep 2022 11:42:29 GMT
serverApache
referrer-policyno-referrer-when-downgrade
last-modifiedThu, 25 Aug 2022 19:48:30 GMT
etag"119-5e71614f2359e"
accept-rangesbytes
content-length281
cache-controlmax-age=0, private, no-cache, no-store, no-transform, must-revalidate
expiresWed, 28 Sep 2022 11:52:29 GMT
varyUser-Agent,Accept-Encoding
feature-policyautoplay 'self';
x-content-type-optionsnosniff
x-xss-protection1; mode=block
x-frame-optionsDENY
strict-transport-securitymax-age=31536000;
content-security-policyreport-uri https://17f7736b07193242e5718c530104cdfa.report-uri.com/r/d/csp/enforce;manifest-src 'none';connect-src 'self';media-src 'self';object-src 'none';child-src 'none';frame-src 'none';worker-src 'none';default-src 'none';script-src 'self';style-src 'self';frame-ancestors 'none';base-uri 'none';font-src 'self';img-src https: data:;frame-ancestors 'none';default-src 'none';
report-to{"group":"default","max_age":31536000,"endpoints":[{"url":"https://cordmail.xyz.report-uri.com/a/d/g"}],"include_subdomains":true}
content-typetext/html
Test History
Results hidden from public stats are not shown here.
| 1 year ago | 93 |
| 1 year ago | 93 |
| 1 year ago | 93 |
| 1 year ago | 93 |
| 1 year ago | 93 |
| 1 year ago | 93 |
| 1 year ago | 91 |
| 1 year ago | 89 |
| 1 year ago | 84 |
| 1 year ago | 83 |
| 1 year ago | 82 |
| 1 year ago | 82 |
| 1 year ago | 82 |
| 1 year ago | 82 |
| 1 year ago | 81 |
| 1 year ago | 81 |
| 1 year ago | 80 |
| 1 year ago | 80 |
| 1 year ago | 79 |
| 1 year ago | 71 |
| 1 year ago | 71 |
| 1 year ago | 61 |
| 1 year ago | 51 |
| 1 year ago | 41 |
| 1 year ago | 41 |
| 1 year ago | 26 |
| 1 year ago | 21 |
| 1 year ago | 41 |
| 2 years ago | 36 |
Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.