Web & Email Security Test
← Web Test Home
F
Test Information
Targetwww.apexmcc.org
Resolved To:https://www.apexmcc.org/
IPv4:172.67.136.173
104.21.56.207
104.21.56.207
Scan ID #:472
Scan Time (UTC):2026-07-04 23:06:44
Response Code (HTTP):301
Response Code (HTTPS):200
Score:24/120
Tests Passed:16/25
Related Tests
Overall Scores
| Test | Pass | Score | Max | Min | Reason | Recommended Apache Config | More |
|---|---|---|---|---|---|---|---|
| HTTPS Availability | ✅ | 0 | 0 | -40 | Site is available over HTTPS and HTTP redirects to HTTPS with same hostname | — | |
| SSL and TLS Protocols | ✅ | +5 | 5 | -20 | TLS v1.2 and TLS v1.3 are supported | SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | 🛈 |
| HSTS (Strict Transport Security) | ❌ | -15 | 0 | -15 | Site is available over HTTPS but no HSTS header sent | Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload | 🛈 |
| Expect Certificate Transparency | ❌ | -5 | 0 | -5 | Site available over HTTPS but no certificate transparency directives | — | |
| HTTP Compression | ➖ | 0 | 1 | 0 | HTTP compression is supported | SetEnv no-gzip 1 | 🛈 |
| Cache Control | ❌ | -5 | 0 | -5 | Cache-Control header not sent | Header set Cache-Control "no-store, no-cache, must-revalidate" | |
| Cookies | ✅ | 0 | 0 | -20 | N/A (No cookies sent) | — | |
| Subresource Integrity | ✅ | +5 | 5 | -10 | Scripts loaded (see subtable for details) | | 🛈 |
| Content-Security-Policy | ❌ | -16 | 0 | -24 | Content-Security-Policy header sent (see subtable for details) | Header set Content-Security-Policy " | 🛈 |
| Feature-Policy | ➖ | 0 | 5 | 0 | Feature-Policy header not sent | Header set Feature-Policy "autoplay 'self';" | |
| Report-To | ➖ | 0 | 1 | 0 | No Report-To header sent | Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true} | |
| Network Error Logging | ➖ | 0 | 1 | 0 | N/A (Requires Report-To header) | Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true} | |
| Referrer Policy | ➖ | 0 | 2 | -5 | Referrer-Policy header not sent | Header always set Referrer-Policy "no-referrer-when-downgrade" | |
| X-Content-Type-Options | ❌ | -10 | 0 | -10 | X-Content-Type-Options header not implemented | Header set X-Content-Type-Options "nosniff" | |
| X-XSS-Protection | ❌ | -10 | 0 | -10 | X-XSS-Protection header not implemented | Header set X-XSS-Protection "1; mode=block" | |
| X-Frame-Options | ❌ | -10 | 0 | -10 | X-Frame-Options header not implemented | Header set X-Frame-Options "DENY" | |
| X-Powered-By | ✅ | 0 | 0 | -3 | X-Powered-By header not sent | Header unset "X-Powered-By" | |
| X-AspNet-Version | ✅ | 0 | 0 | -1 | X-AspNet-Version header not sent | — | |
| X-AspNetMvc-Version | ✅ | 0 | 0 | -1 | X-AspNetMvc-Version header not sent | — | |
| Server Header | ✅ | 0 | 0 | -2 | Server header sent, with general, non-specific value LiteSpeed | ServerTokens Prod | |
| Cross-Origin Resource Sharing | ✅ | 0 | 0 | -15 | CORS header not implemented | — | |
| DNSSEC (DNS Security Extensions) | ❌ | -5 | 0 | -5 | Domain is not signed with a valid signature | — | |
| IPv6 Reachability | ✅ | 0 | 0 | -5 | Nameservers and web server available via IPv6 | — | |
| SPF (Sender Policy Framework) | ✅ | 0 | 0 | -10 | SPF record associated with this domain | — | |
| DMARC (Domain-based Message Authentication, Reporting, and Confidence) | ❌ | -10 | 0 | -10 | An MX record was found for this hostname, but no DMARC record exists | — |
Subresource Integrity (External JavaScript)
Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.
| Script | Pass | Score | Reason | HTTPS |
|---|---|---|---|---|
| /env-config.php | ✅ | 5 | Script is root-relative same-origin and loaded securely | ✅ |
| /assets/index-DX5isfun.js | ✅ | 5 | Script is root-relative same-origin and loaded securely | ✅ |
Content Security Policy
| Directive | Pass | Score | Max | Min | Reason | Current | Recommended Baseline | More |
|---|---|---|---|---|---|---|---|---|
| default-src | ❌ | -1 | 0 | -1 | Missing | 'none' | ||
| script-src | ❌ | -1 | 0 | -4 | Missing | 'self' | ||
| style-src | ❌ | -1 | 0 | -4 | Missing | 'self' | ||
| font-src | ❌ | -1 | 0 | -2 | Missing | 'self' | 🛈 | |
| base-uri | ❌ | -1 | 0 | -1 | Missing | 'none' | ||
| frame-ancestors | ❌ | -1 | 0 | -3 | Missing | 'none' | ||
| form-action | ➖ | 0 | 0 | 0 | Missing, but this directive may not be appropriate | 🛈 | ||
| plugin-types | ✅ | 0 | 0 | 0 | CSP doesn't contain deprecated directive | application/pdf | ||
| object-src | ❌ | -1 | 0 | -1 | Missing | 'none' | ||
| child-src | ❌ | -1 | 0 | -1 | Missing | 'none' | ||
| frame-src | ❌ | -1 | 0 | -1 | Missing | 'none' | ||
| img-src | ❌ | -1 | 0 | -1 | Missing | https: data: | ||
| worker-src | ❌ | -1 | 0 | -1 | Missing | 'none' | ||
| manifest-src | ❌ | -1 | 0 | -1 | Missing | 'none' | ||
| media-src | ❌ | -1 | 0 | -1 | Missing | 'self' | ||
| connect-src | ❌ | -1 | 0 | -1 | Missing | 'self' | 🛈 | |
| report-uri | ❌ | -1 | 0 | -1 | Needed for CSP reporting in CSP version 2 | https://<your-endpoint>.report-uri.com/r/d/csp/enforce | ||
| report-to | ➖ | -1 | 0 | 0 | Needed for CSP reporting in CSP version 3 | default |
Raw Headers
content-typetext/html
last-modifiedFri, 03 Jul 2026 06:27:10 GMT
etag"816-6a47563e-c9ff322e605154d6;br"
accept-rangesbytes
content-encodingbr
varyAccept-Encoding
content-length530
dateSat, 04 Jul 2026 23:06:44 GMT
serverLiteSpeed
platformhostinger
panelhpanel
content-security-policyupgrade-insecure-requests
alt-svch3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Test History
Results hidden from public stats are not shown here.
| 5 days ago | 24 |
| 1 week ago | 19 |
Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.