Web & Email Security Test

← Web Test Home

Test Information

Targetdrudgereport.com

Resolved To:https://drudgereport.com/

IPv4:172.67.12.140
104.22.5.207
104.22.4.207

Scan ID #:367

Scan Time (UTC):2023-07-06 23:28:20

Response Code (HTTP):200

Response Code (HTTPS):200

Score:0/120

Tests Passed:14/25

Domain Information

Changed:

2022-08-01

Created:

1997-02-14

Expires:

2032-02-15

Related Tests

Score floored at 0. Original score was -19.

Overall Scores

Test	Pass	Score	Max	Min	Reason	Recommended Apache Config	More
HTTPS Availability	➖	-10	0	-40	Site is available over HTTPS but HTTP does not redirect to HTTPS with same hostname	`—`
SSL and TLS Protocols	➖	0	5	-20	TLS v1.3 is supported but TLS v1.2 is not supported. Most clients aren't TLS 1.3 capable yet, so you should still support TLS 1.2 for now.	`SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLHonorCipherOrder on SSLCompression off SSLSessionTickets off`	🛈
HSTS (Strict Transport Security)	❌	-15	0	-15	HTTP must redirect to HTTPS on same domain to implement HSTS	`Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload`	🛈
Expect Certificate Transparency	❌	-5	0	-5	Site available over HTTPS but no certificate transparency directives	`—`
HTTP Compression	➖	0	1	0	HTTP compression is supported	`SetEnv no-gzip 1 Header set Cache-Control "max-age=0, private, no-cache, no-store, no-transform, must-revalidate"`	🛈
Cache Control	❌	-5	0	-5	Cache-Control directives are not adequate for sensitive data	`Header set Cache-Control "no-store, no-cache, must-revalidate"`
Cookies	✅	0	0	-20	N/A (No cookies sent)	`—`
Subresource Integrity	❌	-5	5	-10	Scripts loaded (see subtable for details)		🛈
Content-Security-Policy	❌	-24	0	-24	Content-Security-Policy header not sent	`Header set Content-Security-Policy " default-src 'none';\ base-uri 'none';\ etc. [see CSP table];\ report-to default;\ report-uri https://[your-endpoint].report-uri.com/r/d/csp/enforce;"`	🛈
Feature-Policy	➖	0	5	0	Feature-Policy header not sent	`Header set Feature-Policy "autoplay 'self';"`
Report-To	➖	0	1	0	No Report-To header sent	`Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true}`
Network Error Logging	➖	0	1	0	N/A (Requires Report-To header)	`Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true}`
Referrer Policy	➖	0	2	-5	Referrer-Policy header not sent	`Header always set Referrer-Policy "no-referrer-when-downgrade"`
X-Content-Type-Options	❌	-10	0	-10	X-Content-Type-Options header not implemented	`Header set X-Content-Type-Options "nosniff"`
X-XSS-Protection	❌	-10	0	-10	X-XSS-Protection header not implemented	`Header set X-XSS-Protection "1; mode=block"`
X-Frame-Options	❌	-10	0	-10	X-Frame-Options header not implemented	`Header set X-Frame-Options "DENY"`
X-Powered-By	✅	0	0	-3	X-Powered-By header not sent	`Header unset "X-Powered-By"`
X-AspNet-Version	✅	0	0	-1	X-AspNet-Version header not sent	`—`
X-AspNetMvc-Version	✅	0	0	-1	X-AspNetMvc-Version header not sent	`—`
Server Header	✅	0	0	-2	Server header sent, with general, non-specific value `cloudflare`	`ServerTokens Prod`
Cross-Origin Resource Sharing	✅	0	0	-15	CORS header not implemented	`—`
DNSSEC (DNS Security Extensions)	❌	-5	0	-5	Domain is not signed with a valid signature	`—`
IPv6 Reachability	✅	0	0	-5	Nameservers and web server available via IPv6	`—`
SPF (Sender Policy Framework)	❌	-10	0	-10	An MX record was found for this hostname, but no SPF record exists	`—`
DMARC (Domain-based Message Authentication, Reporting, and Confidence)	❌	-10	0	-10	An MX record was found for this hostname, but no DMARC record exists	`—`

Subresource Integrity (External JavaScript)

Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.

Script	Pass	Score	Reason	HTTPS
//cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js	❌	-5	Script is protocol-relative but may not be loaded securely	➖
//eproof.drudgereport.com/dr.js	❌	-5	Script is protocol-relative but may not be loaded securely	➖
/js/cookie_filter_1.0.1.js	➖	0	Script is root-relative same-origin but may not necessarily be loaded securely	➖
//d185y8fkx3tp2z.cloudfront.net/script.js	❌	-5	Script is protocol-relative but may not be loaded securely	➖
https://ads.rubiconproject.com/prebid/21336_drudgeReport.js	❌	-5	Script is external but does not use SRI	✅
//www.googletagservices.com/tag/js/gpt.js	❌	-5	Script is protocol-relative but may not be loaded securely	➖
/js/responsive-4.3.5.js	➖	0	Script is root-relative same-origin but may not necessarily be loaded securely	➖

Raw Headers

dateThu, 06 Jul 2023 23:28:19 GMT

content-typetext/html

content-length10085

content-encodinggzip

strict-transport-securitymax-age=15552000; includeSubDomains; preload

via1.1 google

expiresThu, 06 Jul 2023 21:55:22 GMT

cache-controlpublic, max-age=3

age2

last-modifiedThu, 06 Jul 2023 21:55:05 GMT

etag"707764790"

varyAccept-Encoding

cf-cache-statusHIT

accept-rangesbytes

servercloudflare

cf-ray7e2b9f9c5c2ac481-EWR

Test History

Results hidden from public stats are not shown here.

10 months ago

Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.