Web & Email Security Test

← Web Test Home

B+

Test Information

Targetdeveloper.mozilla.org

Resolved To:https://developer.mozilla.org/en-US/

IPv4:146.75.77.91

Scan ID #:386

Scan Time (UTC):2026-02-15 02:09:01

Response Code (HTTP):301

Response Code (HTTPS):200

Score:77/120

Tests Passed:20/25

Related Tests

Overall Scores

Test	Pass	Score	Max	Min	Reason	Recommended Apache Config	More
HTTPS Availability	✅	0	0	-40	Site is available over HTTPS and HTTP redirects to HTTPS with same hostname	`—`
SSL and TLS Protocols	✅	+5	5	-20	TLS v1.2 and TLS v1.3 are supported	`SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLHonorCipherOrder on SSLCompression off SSLSessionTickets off`	🛈
HSTS (Strict Transport Security)	➖	-5	0	-15	Max-age (730 days) is at least 1 year, but subdomains not included	`Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload`	🛈
Expect Certificate Transparency	❌	-5	0	-5	Site available over HTTPS but no certificate transparency directives	`—`
HTTP Compression	➖	0	1	0	HTTP compression is supported	`SetEnv no-gzip 1 Header set Cache-Control "max-age=0, private, no-cache, no-store, no-transform, must-revalidate"`	🛈
Cache Control	❌	-5	0	-5	Cache-Control directives are not adequate for sensitive data	`Header set Cache-Control "no-store, no-cache, must-revalidate"`
Cookies	✅	0	0	-20	N/A (No cookies sent)	`—`
Subresource Integrity	✅	+5	5	-10	Scripts loaded (see subtable for details)		🛈
Content-Security-Policy	❌	-5	0	-24	Content-Security-Policy header sent (see subtable for details)	`Header set Content-Security-Policy " default-src 'none';\ base-uri 'none';\ etc. [see CSP table];\ report-to default;\ report-uri https://[your-endpoint].report-uri.com/r/d/csp/enforce;"`	🛈
Feature-Policy	➖	0	5	0	Feature-Policy header not sent	`Header set Feature-Policy "autoplay 'self';"`
Report-To	➖	0	1	0	No Report-To header sent	`Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true}`
Network Error Logging	➖	0	1	0	N/A (Requires Report-To header)	`Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true}`
Referrer Policy	✅	+2	2	-5	Effective Referrer policy is secure but may also prevent referer data from being sent to trusted hosts	`Header always set Referrer-Policy "no-referrer-when-downgrade"`
X-Content-Type-Options	✅	0	0	-10	X-Content-Type-Options header securely set	`Header set X-Content-Type-Options "nosniff"`
X-XSS-Protection	❌	-10	0	-10	X-XSS-Protection header not implemented	`Header set X-XSS-Protection "1; mode=block"`
X-Frame-Options	✅	0	0	-10	X-Frame-Options header securely set	`Header set X-Frame-Options "DENY"`
X-Powered-By	✅	0	0	-3	X-Powered-By header not sent	`Header unset "X-Powered-By"`
X-AspNet-Version	✅	0	0	-1	X-AspNet-Version header not sent	`—`
X-AspNetMvc-Version	✅	0	0	-1	X-AspNetMvc-Version header not sent	`—`
Server Header	✅	0	0	-2	Server header sent, with general, non-specific value `Google Frontend`	`ServerTokens Prod`
Cross-Origin Resource Sharing	✅	0	0	-15	CORS header not implemented	`—`
DNSSEC (DNS Security Extensions)	❌	-5	0	-5	Domain is not signed with a valid signature	`—`
IPv6 Reachability	➖	0	0	-5	Nameservers not available	`—`
SPF (Sender Policy Framework)	➖	0	0	-10	No MX records associated with this hostname	`—`
DMARC (Domain-based Message Authentication, Reporting, and Confidence)	➖	0	0	-10	No MX records associated with this hostname	`—`

Subresource Integrity (External JavaScript)

Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.

Script	Pass	Score	Reason	HTTPS
/static/client/runtime.0893fdb4c5a1e2a5.js	✅	5	Script is root-relative same-origin and loaded securely	✅
/static/client/1111.53dba753dc3eb961.js	✅	5	Script is root-relative same-origin and loaded securely	✅
/static/client/8903.ce3ee42276c345b9.js	✅	5	Script is root-relative same-origin and loaded securely	✅
/static/client/index.66cf57a08977d826.js	✅	5	Script is root-relative same-origin and loaded securely	✅

Content Security Policy

Directive	Pass	Score	Min	Reason	Current	Recommended Baseline	More
default-src	❌	-1	-1	Default policy too permissive	'	'none'
script-src	➖	0	-4	JavaScript sources restricted but potentially permissively	'	'self'
style-src	➖	0	-4	CSS sources restricted but potentially permissively	'	'self'
font-src	➖	0	-2	Font sources restricted but potentially permissively	'	'self'	🛈
base-uri	❌	-1	-1	Use of the <base> tag should be restricted	'	'none'
frame-ancestors	❌	-1	-3	Missing		'none'
form-action	➖	0	0	Missing, but this directive may not be appropriate			🛈
plugin-types	✅	0	0	CSP doesn't contain deprecated directive		application/pdf
object-src	➖	0	-1	<object>, <embed>, and <applet> sources restricted but potentially permissively	'	'none'
child-src	➖	0	-1	Web workers and nested browsing contexts sources restricted but potentially permissively	'	'none'
frame-src	➖	0	-1	Frames restricted but potentially permissively	'	'none'
img-src	➖	0	-1	Image sources restricted but potentially permissively	'	https: data:
worker-src	➖	0	-1	Worker, SharedWorker, and ServiceWorker scripts restricted but potentially permissively	'	'none'
manifest-src	➖	0	-1	Manifest sources restricted but potentially permissively	'	'none'
media-src	➖	0	-1	Media sources restricted but potentially permissively	'	'self'
connect-src	➖	0	-1	Script interface URL (e.g. XHR, WS) sources restricted but potentially permissively	'	'self'	🛈
report-uri	❌	-1	-1	Needed for CSP reporting in CSP version 2		https://<your-endpoint>.report-uri.com/r/d/csp/enforce
report-to	➖	-1	0	Needed for CSP reporting in CSP version 3		default

Raw Headers

cache-controlpublic, max-age=3600

x-goog-metageneration1

last-modifiedSun, 15 Feb 2026 01:12:03 GMT

x-goog-stored-content-length109832

strict-transport-securitymax-age=63072000

x-goog-hashcrc32c=1zCZug==, md5=AD0d8vzCEXlRIp2AgJjwJQ==

content-security-policydefault-src 'self'; script-src 'report-sample' 'self' 'wasm-unsafe-eval' https://www.google-analytics.com/analytics.js https://*.googletagmanager.com assets.codepen.io production-assets.codepen.io https://js.stripe.com 'sha256-XNBp89FG76amD8BqrJzyflxOF9PaWPqPqvJfKZPCv7M=' 'sha256-YCNoU9DNiinACbd8n6UPyB/8vj0kXvhkOni9/06SuYw=' 'sha256-PZjP7OR6mBEtnvXIZfCZ5PuOlxoDF1LDZL8aj8c42rw='; script-src-elem 'report-sample' 'self' 'wasm-unsafe-eval' https://www.google-analytics.com/analytics.js https://*.googletagmanager.com assets.codepen.io production-assets.codepen.io https://js.stripe.com 'sha256-XNBp89FG76amD8BqrJzyflxOF9PaWPqPqvJfKZPCv7M=' 'sha256-YCNoU9DNiinACbd8n6UPyB/8vj0kXvhkOni9/06SuYw=' 'sha256-PZjP7OR6mBEtnvXIZfCZ5PuOlxoDF1LDZL8aj8c42rw='; style-src 'report-sample' 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; connect-src 'self' developer.allizom.org bcd.developer.allizom.org bcd.developer.mozilla.org updates.developer.allizom.org updates.developer.mozilla.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://incoming.telemetry.mozilla.org https://observatory-api.mdn.allizom.net https://observatory-api.mdn.mozilla.net https://api.github.com/search/issues stats.g.doubleclick.net https://api.stripe.com; font-src 'self'; frame-src 'self' mdn.github.io *.mdnplay.dev *.mdnyalp.dev *.play.test.mdn.allizom.net https://v2.scrimba.com https://scrimba.com jsfiddle.net www.youtube-nocookie.com codepen.io survey.alchemer.com https://js.stripe.com; img-src 'self' data: *.githubusercontent.com *.googleusercontent.com *.gravatar.com mozillausercontent.com firefoxusercontent.com profile.stage.mozaws.net profile.accounts.firefox.com developer.mozilla.org mdn.dev wikipedia.org upload.wikimedia.org https://mdn.github.io/shared-assets/ https://mdn.dev/ https://*.google-analytics.com https://*.googletagmanager.com www.gstatic.com; manifest-src 'self'; media-src 'self' archive.org videos.cdn.mozilla.net https://mdn.github.io/shared-assets/; child-src 'self'; worker-src 'self';

expiresSun, 15 Feb 2026 02:45:16 GMT

etag"003d1df2fcc2117951229d808098f025"

x-goog-meta-goog-reserved-file-mtime1771116725

x-cloud-trace-contextfce268b9de61f83fc29e654e0df6e79c

via1.1 google, 1.1 varnish, 1.1 varnish, 1.1 varnish

referrer-policystrict-origin-when-cross-origin

x-goog-generation1771117923492561

x-goog-storage-classSTANDARD

content-typetext/html

x-content-type-optionsnosniff

serverGoogle Frontend

x-guploader-uploadidAGQBYWwBO-IimqSwAqFvHgA3n08sx1GG-6dkC33zQzbWsiHSso6E8wbSI2OmNWnPxAsVG3Oc8gqkOOw

x-frame-optionsDENY

x-goog-stored-content-encodingidentity

content-encodingbr

accept-rangesbytes

dateSun, 15 Feb 2026 02:09:01 GMT

age1424

x-served-bycache-bfi-krnt7300047-BFI, cache-bfi-krnt7300047-BFI, cache-lga21934-LGA

x-cacheMISS, HIT, HIT

x-cache-hits0, 11, 1

x-timerS1771121341.137177,VS0,VE2

varyAccept-Encoding

content-length13412

Test History

Results hidden from public stats are not shown here.

1 day ago

Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.