Web & Email Security Test

← Web Test Home

A-

Test Information

TargetdAmn.shadowkitsune.net

Resolved To:https://damn.shadowkitsune.net/

IPv4:104.21.3.56
172.67.130.70

Scan ID #:263

Scan Time (UTC):2022-06-09 09:14:18

Response Code (HTTP):301

Response Code (HTTPS):200

Score:83/120

Tests Passed:22/25

Related Tests

Overall Scores

Test	Pass	Score	Max	Min	Reason	Recommended Apache Config	More
HTTPS Availability	✅	0	0	-40	Site is available over HTTPS and HTTP redirects to HTTPS with same hostname	`—`
SSL and TLS Protocols	➖	0	5	-20	TLS v1.3 is supported but TLS v1.2 is not supported. Most clients aren't TLS 1.3 capable yet, so you should still support TLS 1.2 for now.	`SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLHonorCipherOrder on SSLCompression off SSLSessionTickets off`	🛈
HSTS (Strict Transport Security)	✅	0	0	-15	Max-age (365 days) is at least 1 year, subdomains are included, and is eligible for preloading	`Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload`	🛈
Expect Certificate Transparency	✅	0	0	-5	Certificate transparency expected and enforced	`—`
HTTP Compression	➖	0	1	0	HTTP compression is supported	`SetEnv no-gzip 1 Header set Cache-Control "max-age=0, private, no-cache, no-store, no-transform, must-revalidate"`	🛈
Cache Control	✅	0	0	-5	Cache-Control directives prevent caching	`Header set Cache-Control "no-store, no-cache, must-revalidate"`
Cookies	✅	0	0	-20	N/A (No cookies sent)	`—`
Subresource Integrity	❌	-5	5	-10	Scripts loaded (see subtable for details)		🛈
Content-Security-Policy	❌	-5	0	-24	Content-Security-Policy header sent (see subtable for details)	`Header set Content-Security-Policy " default-src 'none';\ base-uri 'none';\ etc. [see CSP table];\ report-to default;\ report-uri https://[your-endpoint].report-uri.com/r/d/csp/enforce;"`	🛈
Feature-Policy	➖	0	5	0	Feature-Policy header not sent	`Header set Feature-Policy "autoplay 'self';"`
Report-To	✅	+1	1	0	Report-To header sent	`Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true}`
Network Error Logging	➖	0	1	0	No NEL header sent	`Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true}`
Referrer Policy	✅	+2	2	-5	Effective Referrer policy is secure but may also prevent referer data from being sent to trusted hosts	`Header always set Referrer-Policy "no-referrer-when-downgrade"`
X-Content-Type-Options	✅	0	0	-10	X-Content-Type-Options header securely set	`Header set X-Content-Type-Options "nosniff"`
X-XSS-Protection	❌	-10	0	-10	X-XSS-Protection header insecurely set	`Header set X-XSS-Protection "1; mode=block"`
X-Frame-Options	✅	0	0	-10	X-Frame-Options header securely set	`Header set X-Frame-Options "DENY"`
X-Powered-By	✅	0	0	-3	X-Powered-By header not sent	`Header unset "X-Powered-By"`
X-AspNet-Version	✅	0	0	-1	X-AspNet-Version header not sent	`—`
X-AspNetMvc-Version	✅	0	0	-1	X-AspNetMvc-Version header not sent	`—`
Server Header	✅	0	0	-2	Server header sent, with general, non-specific value `cloudflare`	`ServerTokens Prod`
Cross-Origin Resource Sharing	✅	0	0	-15	CORS header not implemented	`—`
DNSSEC (DNS Security Extensions)	✅	0	0	-5	Domain is signed with a valid signature	`—`
IPv6 Reachability	➖	0	0	-5	Nameservers not available	`—`
SPF (Sender Policy Framework)	➖	0	0	-10	No MX records associated with this hostname	`—`
DMARC (Domain-based Message Authentication, Reporting, and Confidence)	➖	0	0	-10	No MX records associated with this hostname	`—`

Subresource Integrity (External JavaScript)

Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.

Script	Pass	Score	Reason	HTTPS
/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1654761600	✅	5	Script is root-relative same-origin and loaded securely	✅
https://js.hcaptcha.com/1/api.js	❌	-5	Script is external but does not use SRI	✅
https://wc6s1svvym7r.statuspage.io/embed/script.js	✅	5	Script is external but uses SRI	✅

Content Security Policy

Directive	Pass	Score	Min	Reason	Current	Recommended Baseline	More
default-src	❌	-1	-1	Default policy too permissive	'	'none'
script-src	➖	0	-4	JavaScript sources restricted but potentially permissively	'	'self'
style-src	➖	0	-4	CSS sources restricted but potentially permissively	'	'self'
font-src	➖	0	-2	Font sources restricted but potentially permissively	'	'self'	🛈
base-uri	❌	-1	-1	Use of the <base> tag should be restricted	'	'none'
frame-ancestors	❌	-1	-3	Site vulnerable to clickjacking attacks	'	'none'
form-action	✅	0	0	Form targets potentially permissive, but this directive may not be appropriate	'		🛈
plugin-types	✅	0	0	CSP doesn't contain deprecated directive		application/pdf
object-src	➖	0	-1	<object>, <embed>, and <applet> sources restricted but potentially permissively	'	'none'
child-src	➖	0	-1	Web workers and nested browsing contexts sources restricted but potentially permissively	'	'none'
frame-src	➖	0	-1	Frames restricted but potentially permissively	hcaptcha.com *.hcaptcha.com wc6s1svvym7r.statuspage.io	'none'
img-src	➖	0	-1	Image sources restricted but potentially permissively	'	https: data:
worker-src	➖	0	-1	Worker, SharedWorker, and ServiceWorker scripts restricted but potentially permissively	'	'none'
manifest-src	❌	-1	-1	Missing		'none'
media-src	❌	-1	-1	Missing		'self'
connect-src	➖	0	-1	Script interface URL (e.g. XHR, WS) sources restricted but potentially permissively	hcaptcha.com *.hcaptcha.com	'self'	🛈
report-uri	✅	0	-1	Needed for CSP reporting in CSP version 2	https://shadowkitsune.report-uri.com/r/d/csp/enforce	https://<your-endpoint>.report-uri.com/r/d/csp/enforce
report-to	✅	0	0	Needed for CSP reporting in CSP version 3	shadowkitsune	default

Raw Headers

dateThu, 09 Jun 2022 09:14:18 GMT

content-typetext/html; charset=UTF-8

content-security-policydefault-src 'none'; script-src 'strict-dynamic' 'nonce-YWU3YzI0ZWM2MTY0N2Q0NjhhMjZlYzQ1Nzc4NTQxZjY=' 'self' static.shadowkitsune.net hcaptcha.com *.hcaptcha.com; style-src 'nonce-YWU3YzI0ZWM2MTY0N2Q0NjhhMjZlYzQ1Nzc4NTQxZjY=' 'self' static.shadowkitsune.net hcaptcha.com *.hcaptcha.com; img-src 'self' static.shadowkitsune.net www.paypalobjects.com; font-src 'self' static.shadowkitsune.net; connect-src hcaptcha.com *.hcaptcha.com; object-src 'none'; frame-src hcaptcha.com *.hcaptcha.com wc6s1svvym7r.statuspage.io; worker-src 'none'; child-src 'none'; frame-ancestors 'none'; form-action 'self' www.paypal.com; upgrade-insecure-requests; base-uri 'none'; report-uri https://shadowkitsune.report-uri.com/r/d/csp/enforce; report-to shadowkitsune

varyAccept-Encoding

strict-transport-securitymax-age=31536000; includeSubDomains; preload

expect-ctmax-age=86400, enforce, report-uri="https://shadowkitsune.report-uri.com/r/d/ct/enforce"

expect-staplemax-age=86400; includeSubDomains; preload; report-uri="https://shadowkitsune.report-uri.com/r/d/staple/reportOnly"

permissions-policyaccelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), focus-without-user-activation=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), sync-script=(), trust-token-redemption=(), window-placement=(), vertical-scroll=()

x-frame-optionsDENY

x-xss-protection0

x-content-type-optionsnosniff

x-permitted-cross-domain-policiesmaster-only

imagetoolbarno

referrer-policystrict-origin-when-cross-origin

x-dns-prefetch-controloff

upgrade-insecure-requests1

cross-origin-resource-policysame-site

cross-origin-opener-policysame-origin

report-to{"group":"shadowkitsune","max_age":31536000,"endpoints":[{"url":"https://shadowkitsune.report-uri.com/a/d/g"}],"include_subdomains":true}

cache-controlmax-age=0, no-store, no-cache, must-revalidate

pragmano-cache

cf-cache-statusDYNAMIC

servercloudflare

cf-ray7188c199cc458c93-EWR

content-encodingbr

alt-svch3=":443"; ma=86400, h3-29=":443"; ma=86400

Test History

Results hidden from public stats are not shown here.

1 year ago

Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.