Web & Email Security Test
← Web Test Home
F
Test Information
Targetwirelessaction.wordpress.com
Resolved To:https://wirelessaction.wordpress.com/
IPv4:192.0.78.13
192.0.78.12
192.0.78.12
Scan ID #:51
Scan Time (UTC):2020-09-17 16:37:57
Response Code (HTTP):301
Response Code (HTTPS):200
Score:16/120
Tests Passed:16/25
Related Tests
Overall Scores
Test | Pass | Score | Max | Min | Reason | Recommended Apache Config | More |
---|---|---|---|---|---|---|---|
HTTPS Availability | ✅ | 0 | 0 | -40 | Site is available over HTTPS and HTTP redirects to HTTPS with same hostname | — | |
SSL and TLS Protocols | ➖ | 0 | 5 | -20 | TLS v1.0/v1.1 are being phased out as certain TLS v1.0 ciphers are not secure | SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | 🛈 |
HSTS (Strict Transport Security) | ❌ | -10 | 0 | -15 | HSTS header sent, but max-age (180 days) is less than 1 year | Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload | 🛈 |
Expect Certificate Transparency | ❌ | -5 | 0 | -5 | Site available over HTTPS but no certificate transparency directives | — | |
HTTP Compression | ➖ | 0 | 1 | 0 | HTTP compression is supported | SetEnv no-gzip 1 | 🛈 |
Cache Control | ❌ | -5 | 0 | -5 | Cache-Control header not sent | Header set Cache-Control "no-store, no-cache, must-revalidate" | |
Cookies | ✅ | 0 | 0 | -20 | N/A (No cookies sent) | — | |
Subresource Integrity | ❌ | -5 | 5 | -10 | Scripts loaded (see subtable for details) |
| 🛈 |
Content-Security-Policy | ❌ | -24 | 0 | -24 | Content-Security-Policy header not sent | Header set Content-Security-Policy " | 🛈 |
Feature-Policy | ➖ | 0 | 5 | 0 | Feature-Policy header not sent | Header set Feature-Policy "autoplay 'self';" | |
Report-To | ➖ | 0 | 1 | 0 | No Report-To header sent | Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true} | |
Network Error Logging | ➖ | 0 | 1 | 0 | N/A (Requires Report-To header) | Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true} | |
Referrer Policy | ➖ | 0 | 2 | -5 | Referrer-Policy header not sent | Header always set Referrer-Policy "no-referrer-when-downgrade" | |
X-Content-Type-Options | ❌ | -10 | 0 | -10 | X-Content-Type-Options header not implemented | Header set X-Content-Type-Options "nosniff" | |
X-XSS-Protection | ❌ | -10 | 0 | -10 | X-XSS-Protection header not implemented | Header set X-XSS-Protection "1; mode=block" | |
X-Frame-Options | ❌ | -10 | 0 | -10 | X-Frame-Options header not implemented | Header set X-Frame-Options "DENY" | |
X-Powered-By | ✅ | 0 | 0 | -3 | X-Powered-By header not sent | Header unset "X-Powered-By" | |
X-AspNet-Version | ✅ | 0 | 0 | -1 | X-AspNet-Version header not sent | — | |
X-AspNetMvc-Version | ✅ | 0 | 0 | -1 | X-AspNetMvc-Version header not sent | — | |
Server Header | ✅ | 0 | 0 | -2 | Server header sent, with general, non-specific value nginx | ServerTokens Prod | |
Cross-Origin Resource Sharing | ✅ | 0 | 0 | -15 | CORS header not implemented | — | |
DNSSEC (DNS Security Extensions) | ❌ | -5 | 0 | -5 | Domain is not signed with a valid signature | — | |
IPv6 Reachability | ➖ | 0 | 0 | -5 | Nameservers not available | — | |
SPF (Sender Policy Framework) | ➖ | 0 | 0 | -10 | No MX records associated with this hostname | — | |
DMARC (Domain-based Message Authentication, Reporting, and Confidence) | ➖ | 0 | 0 | -10 | No MX records associated with this hostname | — |
Subresource Integrity (External JavaScript)
Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.
Script | Pass | Score | Reason | HTTPS |
---|---|---|---|---|
https://s2.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j | ❌ | -5 | Script is external but does not use SRI | ✅ |
//0.gravatar.com/js/gprofiles.js?ver=202038y | ✅ | 5 | Script is protocol-relative and loaded securely | ➖ |
https://s1.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1380573781h | ❌ | -5 | Script is external but does not use SRI | ✅ |
https://s2.wp.com/_static/??-eJyVkNtqw0AMRH+oW1GoSfNQ+i3KWnHkvbLS2vn8yi8hlxKaJ4nRnIERrNX5kpWywiww0sKe6vl9lje4OqXuauwTZwFfUjLJRQ4kGxP5ALJypVegG+Ee1BMls9VuwRRx82dceELlkv9hlsDVknNwx+K7uCM/FPqLsvmkwsrjRCpA3a4lMLmIKyilGlHpTn+Sg2Pi7A7YIKEoNdtcWag1Hi3lor2YoA19eHjkNeS3523QZTP3T/r+GHaf+93XMOznX03sw6w= | ❌ | -5 | Script is external but does not use SRI | ✅ |
//stats.wp.com/w.js?61 | ✅ | 5 | Script is protocol-relative and loaded securely | ➖ |
Raw Headers
servernginx
dateThu, 17 Sep 2020 16:37:57 GMT
content-typetext/html; charset=UTF-8
connectionkeep-alive
varyAccept-Encoding
varyCookie
x-hackerIf you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
link<https://wp.me/P7RfiD-2>; rel=shortlink
content-encodinggzip
x-ac1.dfw _dfw
strict-transport-securitymax-age=15552000
Test History
Results hidden from public stats are not shown here.
3 years ago | 15 |
Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.