Web & Email Security Test
← Web Test Home
F
Test Information
Targetsoulnode.net
Resolved To:https://soulnode.net/
IPv4:67.225.218.40
Scan ID #:144
Scan Time (UTC):2021-06-13 21:37:38
Response Code (HTTP):301
Response Code (HTTPS):200
Score:8/120
Tests Passed:15/25
Domain Information
Changed:
2021-01-28
Created:
2021-01-04
Expires:
2022-01-04
Related Tests
Overall Scores
Test | Pass | Score | Max | Min | Reason | Recommended Apache Config | More |
---|---|---|---|---|---|---|---|
HTTPS Availability | ✅ | 0 | 0 | -40 | Site is available over HTTPS and HTTP redirects to HTTPS with same hostname | — | |
SSL and TLS Protocols | ✅ | +5 | 5 | -20 | TLS v1.2 and TLS v1.3 are supported | SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | 🛈 |
HSTS (Strict Transport Security) | ❌ | -15 | 0 | -15 | Site is available over HTTPS but no HSTS header sent | Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload | 🛈 |
Expect Certificate Transparency | ✅ | 0 | 0 | -5 | Certificate transparency expected but not enforced | — | |
HTTP Compression | ➖ | 0 | 1 | 0 | HTTP compression is supported | SetEnv no-gzip 1 | 🛈 |
Cache Control | ❌ | -5 | 0 | -5 | Cache-Control header not sent | Header set Cache-Control "no-store, no-cache, must-revalidate" | |
Cookies | ✅ | 0 | 0 | -20 | N/A (No cookies sent) | — | |
Subresource Integrity | ❌ | -5 | 5 | -10 | Scripts loaded (see subtable for details) |
| 🛈 |
Content-Security-Policy | ❌ | -24 | 0 | -24 | Content-Security-Policy header not sent | Header set Content-Security-Policy " | 🛈 |
Feature-Policy | ➖ | 0 | 5 | 0 | Feature-Policy header not sent | Header set Feature-Policy "autoplay 'self';" | |
Report-To | ✅ | +1 | 1 | 0 | Report-To header sent | Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true} | |
Network Error Logging | ✅ | +1 | 1 | 0 | NEL header sent | Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true} | |
Referrer Policy | ➖ | 0 | 2 | -5 | Referrer-Policy header not sent | Header always set Referrer-Policy "no-referrer-when-downgrade" | |
X-Content-Type-Options | ❌ | -10 | 0 | -10 | X-Content-Type-Options header not implemented | Header set X-Content-Type-Options "nosniff" | |
X-XSS-Protection | ❌ | -10 | 0 | -10 | X-XSS-Protection header not implemented | Header set X-XSS-Protection "1; mode=block" | |
X-Frame-Options | ❌ | -10 | 0 | -10 | X-Frame-Options header not implemented | Header set X-Frame-Options "DENY" | |
X-Powered-By | ✅ | 0 | 0 | -3 | X-Powered-By header not sent | Header unset "X-Powered-By" | |
X-AspNet-Version | ✅ | 0 | 0 | -1 | X-AspNet-Version header not sent | — | |
X-AspNetMvc-Version | ✅ | 0 | 0 | -1 | X-AspNetMvc-Version header not sent | — | |
Server Header | ✅ | 0 | 0 | -2 | Server header sent, with general, non-specific value cloudflare | ServerTokens Prod | |
Cross-Origin Resource Sharing | ✅ | 0 | 0 | -15 | CORS header not implemented | — | |
DNSSEC (DNS Security Extensions) | ❌ | -5 | 0 | -5 | Domain is not signed with a valid signature | — | |
IPv6 Reachability | ❌ | -5 | 0 | -5 | Nameservers available via IPv6, but web server is not | — | |
SPF (Sender Policy Framework) | ✅ | 0 | 0 | -10 | SPF record associated with this domain | — | |
DMARC (Domain-based Message Authentication, Reporting, and Confidence) | ❌ | -10 | 0 | -10 | An MX record was found for this hostname, but no DMARC record exists | — |
Subresource Integrity (External JavaScript)
Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.
Script | Pass | Score | Reason | HTTPS |
---|---|---|---|---|
https://www.googletagmanager.com/gtag/js?id=G-D1924DZ88L | ➖ | 0 | Script is external but frequently changes, so cannot reasonably use SRI | ✅ |
https://arc.io/widget.min.js#9dx3mbFm | ❌ | -5 | Script is external but does not use SRI | ✅ |
lib/jquery/jquery.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/jquery/jquery-migrate.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/bootstrap/js/bootstrap.bundle.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/easing/easing.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/superfish/hoverIntent.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/superfish/superfish.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/wow/wow.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/waypoints/waypoints.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/counterup/counterup.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/owlcarousel/owl.carousel.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/isotope/isotope.pkgd.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/lightbox/js/lightbox.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
lib/touchSwipe/jquery.touchSwipe.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
js/main.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
assets/js/jquery-2.1.0.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
assets/js/popper.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
assets/js/bootstrap.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
assets/js/scrollreveal.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
assets/js/waypoints.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
assets/js/jquery.counterup.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
assets/js/imgfix.min.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
assets/js/custom.js | ✅ | 5 | Script is relative same-origin and loaded securely | ✅ |
Raw Headers
dateSun, 13 Jun 2021 21:37:38 GMT
content-typetext/html
connectionkeep-alive
last-modifiedSat, 29 May 2021 21:04:41 GMT
varyAccept-Encoding,User-Agent
cf-cache-statusDYNAMIC
cf-request-id0aa8e820ba0000e72c4030c000000001
expect-ctmax-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jb%2BwEDbeVZkTDGHtnv82hyHSq0zcxCgIH3%2FVZlfRK23xocwiddnsihhhRKfi0O68FH%2BWEbu45SwNzYD52ExPahWwZHF4pzpBKXo5IBjvjLcRrQb62K2gQpcO"}],"group":"cf-nel","max_age":604800}
nel{"report_to":"cf-nel","max_age":604800}
servercloudflare
cf-ray65ee76145d25e72c-EWR
content-encodinggzip
alt-svch3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Test History
Results hidden from public stats are not shown here.
2 years ago | 12 |
Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.