Web & Email Security Test
← Web Test Home
F
Test Information
Targetrepl.it
Resolved To:https://replit.com/
IPv4:172.67.74.238
104.26.6.167
104.26.7.167
104.26.6.167
104.26.7.167
Scan ID #:334
Scan Time (UTC):2022-10-05 00:10:29
Response Code (HTTP):302
Response Code (HTTPS):200
Score:28/120
Tests Passed:17/25
Related Tests
Overall Scores
Test | Pass | Score | Max | Min | Reason | Recommended Apache Config | More |
---|---|---|---|---|---|---|---|
HTTPS Availability | ✅ | 0 | 0 | -40 | Site is available over HTTPS and HTTP redirects to HTTPS with same hostname | — | |
SSL and TLS Protocols | ➖ | 0 | 5 | -20 | TLS v1.3 is supported but TLS v1.2 is not supported. Most clients aren't TLS 1.3 capable yet, so you should still support TLS 1.2 for now. | SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | 🛈 |
HSTS (Strict Transport Security) | ➖ | -5 | 0 | -15 | Max-age (365 days) is at least 1 year, but subdomains not included | Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload | 🛈 |
Expect Certificate Transparency | ❌ | -5 | 0 | -5 | Site available over HTTPS but no certificate transparency directives | — | |
HTTP Compression | ➖ | 0 | 1 | 0 | HTTP compression is supported | SetEnv no-gzip 1 | 🛈 |
Cache Control | ❌ | -5 | 0 | -5 | Cache-Control directives are not adequate for sensitive data | Header set Cache-Control "no-store, no-cache, must-revalidate" | |
Cookies | ✅ | 0 | 0 | -20 | N/A (No cookies sent) | — | |
Subresource Integrity | ❌ | -5 | 5 | -10 | Scripts loaded (see subtable for details) |
| 🛈 |
Content-Security-Policy | ❌ | -24 | 0 | -24 | Content-Security-Policy header not sent | Header set Content-Security-Policy " | 🛈 |
Feature-Policy | ➖ | 0 | 5 | 0 | Feature-Policy header not sent | Header set Feature-Policy "autoplay 'self';" | |
Report-To | ➖ | 0 | 1 | 0 | No Report-To header sent | Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true} | |
Network Error Logging | ➖ | 0 | 1 | 0 | N/A (Requires Report-To header) | Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true} | |
Referrer Policy | ➖ | 0 | 2 | -5 | Referrer-Policy header not sent | Header always set Referrer-Policy "no-referrer-when-downgrade" | |
X-Content-Type-Options | ❌ | -10 | 0 | -10 | X-Content-Type-Options header not implemented | Header set X-Content-Type-Options "nosniff" | |
X-XSS-Protection | ❌ | -10 | 0 | -10 | X-XSS-Protection header not implemented | Header set X-XSS-Protection "1; mode=block" | |
X-Frame-Options | ✅ | 0 | 0 | -10 | X-Frame-Options header securely set | Header set X-Frame-Options "DENY" | |
X-Powered-By | ❌ | -3 | 0 | -3 | X-Powered-By header sent, with value Next.js | Header unset "X-Powered-By" | |
X-AspNet-Version | ✅ | 0 | 0 | -1 | X-AspNet-Version header not sent | — | |
X-AspNetMvc-Version | ✅ | 0 | 0 | -1 | X-AspNetMvc-Version header not sent | — | |
Server Header | ✅ | 0 | 0 | -2 | Server header sent, with general, non-specific value cloudflare | ServerTokens Prod | |
Cross-Origin Resource Sharing | ✅ | 0 | 0 | -15 | CORS header not implemented | — | |
DNSSEC (DNS Security Extensions) | ❌ | -5 | 0 | -5 | Domain is not signed with a valid signature | — | |
IPv6 Reachability | ✅ | 0 | 0 | -5 | Nameservers and web server available via IPv6 | — | |
SPF (Sender Policy Framework) | ✅ | 0 | 0 | -10 | SPF record associated with this domain | — | |
DMARC (Domain-based Message Authentication, Reporting, and Confidence) | ✅ | 0 | 0 | -10 | Strict (reject) DMARC policy associated with this domain | — |
Subresource Integrity (External JavaScript)
Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.
Script | Pass | Score | Reason | HTTPS |
---|---|---|---|---|
https://ld.replit.com/ | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://polyfill.io/v3/polyfill.min.js?features=default,es2015,es2016,es2017,es2018,es2019,es2020,es2021,ResizeObserver,smoothscroll,TextEncoder | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://js.stripe.com/v3/ | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/polyfills-c67a75d1b6f99dc8.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/webpack-a624155de2bda8e3.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/framework-2ff0b62030a2cbdb.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/main-86089424c51b4a5f.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/pages/_app-a04ab1fdcb9d25c2.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/29107295-b133b9f0bd8c6f37.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/4ad82c5e-36d7a411e1d6c71e.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/fbb05e6d-0071417ca2d26993.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/1627-c05a2382146e7810.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/8764-40819805db00bf33.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/9037-0088621259dff446.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/1502-2d151a14f339a8e7.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/4036-e141c6292b025217.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/395-e6b4df9a32993ebf.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/8738-7b5ce022e8efd130.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/6015-c29afdc459b82c25.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/chunks/pages/index-11ae9434ef8ddb6e.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/6ClYk-2C1FemiUUer-dVs/_buildManifest.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://cdn.replit.com/_next/static/6ClYk-2C1FemiUUer-dVs/_ssgManifest.js | ❌ | -5 | Script is external but does not use SRI | ✅ |
Raw Headers
dateWed, 05 Oct 2022 00:10:29 GMT
content-typetext/html; charset=utf-8
cf-ray7551ef3e9b4e8c8f-EWR
age507
cache-controlpublic, max-age=3600
strict-transport-securitymax-age=31536000; preload
varyAccept-Encoding
cf-cache-statusHIT
x-frame-optionsDENY
x-powered-byNext.js
servercloudflare
content-encodingbr
Test History
Results hidden from public stats are not shown here.
1 year ago | 28 |
Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.