Web & Email Security Test

← Web Test Home

Test Information

Targetdrudgereport.com

Resolved To:https://drudgereport.com/

IPv4:52.85.61.89
52.85.61.84
52.85.61.116
52.85.61.6

Scan ID #:367

Scan Time (UTC):2023-07-06 23:28:20

Response Code (HTTP):200

Response Code (HTTPS):200

Score:0/120

Tests Passed:15/25

Domain Information

Changed:

2022-08-01

Created:

1997-02-14

Expires:

2032-02-15

Related Tests

Score floored at 0. Original score was -7.

Overall Scores

Test	Pass	Score	Max	Min	Reason	Recommended Apache Config	More
HTTPS Availability	➖	-10	0	-40	Site is available over HTTPS but HTTP does not redirect to HTTPS with same hostname	`—`
SSL and TLS Protocols	➖	0	5	-20	TLS v1.3 is supported but TLS v1.2 is not supported. Most clients aren't TLS 1.3 capable yet, so you should still support TLS 1.2 for now.	`SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLHonorCipherOrder on SSLCompression off SSLSessionTickets off`	🛈
HSTS (Strict Transport Security)	❌	-15	0	-15	HTTP must redirect to HTTPS on same domain to implement HSTS	`Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload`	🛈
Expect Certificate Transparency	❌	-5	0	-5	Site available over HTTPS but no certificate transparency directives	`—`
HTTP Compression	➖	0	1	0	HTTP compression is supported	`SetEnv no-gzip 1 Header set Cache-Control "max-age=0, private, no-cache, no-store, no-transform, must-revalidate"`	🛈
Cache Control	❌	-5	0	-5	Cache-Control directives are not adequate for sensitive data	`Header set Cache-Control "no-store, no-cache, must-revalidate"`
Cookies	✅	0	0	-20	N/A (No cookies sent)	`—`
Subresource Integrity	❌	-5	5	-10	Scripts loaded (see subtable for details)		🛈
Content-Security-Policy	❌	-24	0	-24	Content-Security-Policy header not sent	`Header set Content-Security-Policy " default-src 'none';\ base-uri 'none';\ etc. [see CSP table];\ report-to default;\ report-uri https://[your-endpoint].report-uri.com/r/d/csp/enforce;"`	🛈
Feature-Policy	➖	0	5	0	Feature-Policy header not sent	`Header set Feature-Policy "autoplay 'self';"`
Report-To	➖	0	1	0	No Report-To header sent	`Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true}`
Network Error Logging	➖	0	1	0	N/A (Requires Report-To header)	`Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true}`
Referrer Policy	➖	0	2	-5	Referrer-Policy header not sent	`Header always set Referrer-Policy "no-referrer-when-downgrade"`
X-Content-Type-Options	❌	-10	0	-10	X-Content-Type-Options header not implemented	`Header set X-Content-Type-Options "nosniff"`
X-XSS-Protection	❌	-10	0	-10	X-XSS-Protection header not implemented	`Header set X-XSS-Protection "1; mode=block"`
X-Frame-Options	❌	-10	0	-10	X-Frame-Options header not implemented	`Header set X-Frame-Options "DENY"`
X-Powered-By	✅	0	0	-3	X-Powered-By header not sent	`Header unset "X-Powered-By"`
X-AspNet-Version	✅	0	0	-1	X-AspNet-Version header not sent	`—`
X-AspNetMvc-Version	✅	0	0	-1	X-AspNetMvc-Version header not sent	`—`
Server Header	✅	0	0	-2	Server header sent, with general, non-specific value `cloudflare`	`ServerTokens Prod`
Cross-Origin Resource Sharing	✅	0	0	-15	CORS header not implemented	`—`
DNSSEC (DNS Security Extensions)	❌	-5	0	-5	Domain is not signed with a valid signature	`—`
IPv6 Reachability	❌	-5	0	-5	Nameservers available via IPv6, but web server is not	`—`
SPF (Sender Policy Framework)	✅	0	0	-10	SPF record associated with this domain	`—`
DMARC (Domain-based Message Authentication, Reporting, and Confidence)	➖	-3	0	-10	Insufficiently strict (none) DMARC record associated with this domain	`—`

Subresource Integrity (External JavaScript)

Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.

Script	Pass	Score	Reason	HTTPS
//cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js	❌	-5	Script is protocol-relative but may not be loaded securely	➖
//eproof.drudgereport.com/dr.js	❌	-5	Script is protocol-relative but may not be loaded securely	➖
/js/cookie_filter_1.0.1.js	➖	0	Script is root-relative same-origin but may not necessarily be loaded securely	➖
//d185y8fkx3tp2z.cloudfront.net/script.js	❌	-5	Script is protocol-relative but may not be loaded securely	➖
https://ads.rubiconproject.com/prebid/21336_drudgeReport.js	❌	-5	Script is external but does not use SRI	✅
//www.googletagservices.com/tag/js/gpt.js	❌	-5	Script is protocol-relative but may not be loaded securely	➖
/js/responsive-4.3.5.js	➖	0	Script is root-relative same-origin but may not necessarily be loaded securely	➖

Raw Headers

dateThu, 06 Jul 2023 23:28:19 GMT

content-typetext/html

content-length10085

content-encodinggzip

strict-transport-securitymax-age=15552000; includeSubDomains; preload

via1.1 google

expiresThu, 06 Jul 2023 21:55:22 GMT

cache-controlpublic, max-age=3

age2

last-modifiedThu, 06 Jul 2023 21:55:05 GMT

etag"707764790"

varyAccept-Encoding

cf-cache-statusHIT

accept-rangesbytes

servercloudflare

cf-ray7e2b9f9c5c2ac481-EWR

Test History

Results hidden from public stats are not shown here.

1 year ago

Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.