Web & Email Security Test

← Web Test Home

D+

Test Information

Targetwww.hadaller.ca

Resolved To:https://www.hadaller.ca/

IPv4:142.251.214.211

Scan ID #:444

Scan Time (UTC):2026-05-18 16:36:58

Response Code (HTTP):301

Response Code (HTTPS):200

Score:44/120

Tests Passed:18/25

Related Tests

Overall Scores

Test	Pass	Score	Max	Min	Reason	Recommended Apache Config	More
HTTPS Availability	✅	0	0	-40	Site is available over HTTPS and HTTP redirects to HTTPS with same hostname	`—`
SSL and TLS Protocols	➖	0	5	-20	TLS v1.0/v1.1 are being phased out as certain TLS v1.0 ciphers are not secure	`SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLHonorCipherOrder on SSLCompression off SSLSessionTickets off`	🛈
HSTS (Strict Transport Security)	❌	-15	0	-15	Site is available over HTTPS but no HSTS header sent	`Header set Strict-Transport-Security max-age=31536000; includeSubDomains; preload`	🛈
Expect Certificate Transparency	❌	-5	0	-5	Site available over HTTPS but no certificate transparency directives	`—`
HTTP Compression	✅	+1	1	0	Content-Encoding header not sent	`SetEnv no-gzip 1 Header set Cache-Control "max-age=0, private, no-cache, no-store, no-transform, must-revalidate"`	🛈
Cache Control	✅	0	0	-5	Cache-Control directives prevent caching	`Header set Cache-Control "no-store, no-cache, must-revalidate"`
Cookies	✅	0	0	-20	N/A (No cookies sent)	`—`
Subresource Integrity	❌	-5	5	-10	Scripts loaded (see subtable for details)		🛈
Content-Security-Policy	❌	-12	0	-24	Content-Security-Policy header sent (see subtable for details)	`Header set Content-Security-Policy " default-src 'none';\ base-uri 'none';\ etc. [see CSP table];\ report-to default;\ report-uri https://[your-endpoint].report-uri.com/r/d/csp/enforce;"`	🛈
Feature-Policy	➖	0	5	0	Feature-Policy header not sent	`Header set Feature-Policy "autoplay 'self';"`
Report-To	➖	0	1	0	No Report-To header sent	`Header set Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://[your-endpoint].report-uri.com/a/d/g"}],"include_subdomains":true}`
Network Error Logging	➖	0	1	0	N/A (Requires Report-To header)	`Header set NEL: {"report_to":"default","max_age":31536000,"include_subdomains":true}`
Referrer Policy	❌	-5	2	-5	Effective Referrer policy is not secure	`Header always set Referrer-Policy "no-referrer-when-downgrade"`
X-Content-Type-Options	✅	0	0	-10	X-Content-Type-Options header securely set	`Header set X-Content-Type-Options "nosniff"`
X-XSS-Protection	❌	-10	0	-10	X-XSS-Protection header insecurely set	`Header set X-XSS-Protection "1; mode=block"`
X-Frame-Options	✅	0	0	-10	X-Frame-Options header securely set	`Header set X-Frame-Options "DENY"`
X-Powered-By	✅	0	0	-3	X-Powered-By header not sent	`Header unset "X-Powered-By"`
X-AspNet-Version	✅	0	0	-1	X-AspNet-Version header not sent	`—`
X-AspNetMvc-Version	✅	0	0	-1	X-AspNetMvc-Version header not sent	`—`
Server Header	✅	0	0	-2	Server header sent, with general, non-specific value `ESF`	`ServerTokens Prod`
Cross-Origin Resource Sharing	✅	0	0	-15	CORS header not implemented	`—`
DNSSEC (DNS Security Extensions)	❌	-5	0	-5	Domain is not signed with a valid signature	`—`
IPv6 Reachability	➖	0	0	-5	Nameservers not available	`—`
SPF (Sender Policy Framework)	➖	0	0	-10	No MX records associated with this hostname	`—`
DMARC (Domain-based Message Authentication, Reporting, and Confidence)	➖	0	0	-10	No MX records associated with this hostname	`—`

Subresource Integrity (External JavaScript)

Maximum score for any and all scripts is 5 and minimum score for any and all scripts is -10.

Script	Pass	Score	Reason	HTTPS
https://apis.google.com/js/client.js?onload=gapiLoaded	❌	-5	Script is external but does not use SRI	✅
https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.mRLEYWzOxtw.O/am=CCDAAYA/d=1/rs=AGEqA5mJanmVa3DXrwYdj1d7D1RLeD9XbA/m=view	❌	-5	Script is external but does not use SRI	✅

Content Security Policy

Directive	Pass	Score	Min	Reason	Current	Recommended Baseline	More
default-src	❌	-1	-1	Missing		'none'
script-src	➖	0	-4	JavaScript sources restricted but potentially permissively	'	'self'
style-src	❌	-1	-4	Missing		'self'
font-src	❌	-1	-2	Missing		'self'	🛈
base-uri	❌	-1	-1	Use of the <base> tag should be restricted	'	'none'
frame-ancestors	❌	-1	-3	Site vulnerable to clickjacking attacks	https://google-admin.corp.google.com/	'none'
form-action	➖	0	0	Missing, but this directive may not be appropriate			🛈
plugin-types	✅	0	0	CSP doesn't contain deprecated directive		application/pdf
object-src	➖	0	-1	<object>, <embed>, and <applet> sources restricted but potentially permissively	'	'none'
child-src	❌	-1	-1	Missing		'none'
frame-src	❌	-1	-1	Missing		'none'
img-src	❌	-1	-1	Missing		https: data:
worker-src	➖	0	-1	Worker, SharedWorker, and ServiceWorker scripts restricted but potentially permissively	'	'none'
manifest-src	❌	-1	-1	Missing		'none'
media-src	❌	-1	-1	Missing		'self'
connect-src	❌	-1	-1	Missing		'self'	🛈
report-uri	✅	0	-1	Needed for CSP reporting in CSP version 2	/_/view/cspreport	https://<your-endpoint>.report-uri.com/r/d/csp/enforce
report-to	➖	-1	0	Needed for CSP reporting in CSP version 3		default

Raw Headers

content-typetext/html; charset=utf-8

x-frame-optionsDENY

varySec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site

cache-controlno-cache, no-store, max-age=0, must-revalidate

pragmano-cache

expiresMon, 01 Jan 1990 00:00:00 GMT

dateMon, 18 May 2026 16:36:57 GMT

content-length0

cross-origin-resource-policysame-site

content-security-policybase-uri 'self';object-src 'none';report-uri /_/view/cspreport;script-src 'report-sample' 'nonce-j1fstQyxW6Z9uBLX4DAoxA' 'unsafe-inline' 'unsafe-eval';worker-src 'self';frame-ancestors https://google-admin.corp.google.com/

cross-origin-opener-policyunsafe-none

reporting-endpointsdefault="/web-reports?jobset=prod&wcrumsspbp=false&bl=editors.sites-viewer-frontend_20260513.02_p1&app=25&clss=1&context=eJwN0mlUk3caBfCQvO_9IwSQkAhSREgsBkVEHUUFChQRqjPUpU4onLqjIq4IuE1dpsVRz3Rsp7hNp8UFRhDEBVRatVpxq1YRl6IWRSuCIBASQBKoMvfD78O9357nXKcLmlxHk-KIs0kxRWtSfETuX5oU_vR2j0nhutekkA6YFFqKPmFSVDSbFHcpc1CiIpvGD61WvCUEVSt8KfJ3qzKOzJs7lV20Nq1LuZl-Drcpq-hshE15iV6n2JRv6dB2m_Iozb1uVy6m_klvlf60TNGrzCKbT69SMaBX2bGmV_kHzdunVKXRqOkqVRhFblap4mjaC5UqidaYx0ubSLknXHKi74vDpZ8ofmyENIVKfKKlU2SZFC3Z6bf170vPaeeKGOlbmpcVI6WR8liM5ETjTsVI0TR2cawURe-ujJWG0ef1sdI_KXH0RGk25fwrTsqjhq44yUx70uKlffRc84H0imrEJKmOVk_PlTfSq0W5cjs9OJ0rP6Wq9n3yQ_L78IBspDk1B-VU-tR8UM6mM4vy5Ao6vCRPPkHXn-fJd8jreL7sRzcT_iffJ5fsQ7KO-g8skP3J-HGBHEL64gJ5WtNhOYkKE4rk45Q-r0ReR01LS2Qrua1ukj0pMbJZnk3JF5vleXQ_sUV-TG7ftMie1HNIDVWBGsfcXFBOAeUuCKbqS66opb_kumEGFb10RyktanLHChIhGrjRDyUaXCQHvQf6UGmoB85Q1FgPxFPpHGYa-ViL8aRL0GEA_XudDv-hhi06mGnjgX74Bw2u6Yfh5LTEExrqXuYJp-We2Obnha9o4WgvNKZ4wUJlR7xwlmw_e0Fx3Qt_298fn9O9A_1RQ6u3e2MjfdvljXyq-_IdNFPyJB_MpsBLPhhBtUW-uPbIFzfJaPZFCM2w-CKJHlEtnU0eiPMLBuISNW0YCDM1lQ2ElSYLP0ynV6l-aC33w2taf9Afn1HJM3-coiXD9cigMXF6hJEuU48B1JOth2qLHme26lFBafv0WEXnbupxkdS39HCnLvqDJlbqMZkK6Ai539ajH33xVo-d9CbcADnCgGORBpRTb4YBItOAtrUGdFLSPQPmUt6gABTTJFMAppFv52AY6JZkxK_kACP6UDGVkdXFiG5yczdCS9_Tj6QPMmII7f3aiP109YARlfRrvRFPqNwtEBeozj0QzfTQIxDPqEcbCJUuEHcUYbhRFIa7NP94GFJJdSIMjnSDbtOu0jAUJYSjlFbsisAa2r3tPeTS5D6RmE6hiihEkuFSFIbSwz3RaLwdDQttborGNrIsiYGdRF0M1HRZNwE36UnrBNTT4_WxeEELN03EcjLkTcRQGndtIqKpJSMOnaQvjsMQ2vQ0Dlvp6-B4fEMVtfG4QY2OH8BCT7b_jnqqbX2OBtJMrYM3XaVKcrLXQUMtBfXopMVF9UinXyIbUEVL814ik2YPbsQi2vG0EbupqrkJD0mveYUhVHi6GcdpV0oLvqOW6hZ0Ukt4Kzop4HQrNFvNeFNqhlxmxsqINuhntmEIFaW3oZSKP2vD7po2ND9tQ8ifLCjcaYHrHgv2nrQgJ9yK_1Ltn634ZbEVF3KsuExrd1qxgTxKrPCiGdp2nJ_azvvaUT-rHQlz22Fa18G_dmBqRQfWUOyrDsTTre5O3KXGB6_RSvkDunCY9s_swtCFXbiituGdATZE6W0QPTa40fgJdrxP9XvteE03jtrx3jE7Ikn9wA4tjX5kxzhamtSNdKpO7kYNjSrpRhj9ltyD0Ds9eDznDV5Q0sk3mEs_9r7BFarw7MUNOubbC-9tvbha2YtKCpigEMHU0KEQZsoxOYjd5DnTQVy94iB8rzmIZ2VKkdCqFDatSmR9rBIbqPSkSvi7SCLbQxJfUIteEvGfSGIKzZkviVSyrZfEzL9LIrRSEhOomJqqJHH-viQcfWSRNkYW--NlUUgrwyDWks8CiElUvQGilpZVQ2RRjZXzpvJdQlygQ1VC5K9xFIWUs8FRhG1xFKFljmLHHUeRFdpHPOnuI55T8mUnkfPSSVjedRYJAc4iLdBZnI11FoM_chbb65zFwslq4b1ELRT5auFzTi3K76rFBXp20UV8es9FZNMP1S7C-YmLcKEgsvR3FcMDXIUhwlXs3eEqvqNPDrqKzF1uovzDvuJwYl9xLrOvCCroK4JpcbZGlJ3XCGWNRkhUud5DKK55iMqVWrEjSyt205R9WnH8qFaUk_oR-xdacbBBK3z9deKr0TrhM0YnfMmP9DSIAshIQyiIgimEpsfpxE8L-4nBV_uJFzM8hT3RU2jUjoWbjtxG36ct-Q9U3tJfU1NW64NS5qdmLE9fFbwqNSNl1bAsdinpwxakL1-WkbJs_qyRISPHhIweMSo4ZOSsFSP-D76ZZpA&build-label=editors.sites-viewer-frontend_20260513.02_p1&imp-sid=CLG1wt6iw5QDFV_BzgAd2ZkgpQ&is-cached-offline=false"

document-policyinclude-js-call-stacks-in-crash-reports

referrer-policyorigin

serverESF

x-xss-protection0

x-content-type-optionsnosniff

Test History

Results hidden from public stats are not shown here.

11 hours ago

Was this test helpful? Are there things we could improve? If so, please let us know! If you'd like to support it, donations are greatly appreciated.