Checks
What each result means
These are the individual results a scan can report, such as “CSP allows unsafe-inline”. Open one to see what it means and what to do.
Transport
- Target uses HTTPSThe URL you scanned already uses HTTPS.
- HTTP to HTTPS redirect not probedThe plaintext HTTP probe was skipped because this was a local self-scan of the scanner itself.
- HTTP endpoint unreachableThe scanner could not open the HTTP URL for the same host.
- HTTP redirects to HTTPSThe HTTP endpoint answered 301 or 308 with a Location that starts with https://.
- HTTP redirects to HTTPS (temporary)HTTP redirects to HTTPS with 302, 303, or 307.
- HTTP does not redirect to HTTPSThe HTTP endpoint responded without a redirect whose Location starts with https://.
- HTTP URL scannedThe URL submitted to the scanner used HTTP.
- IPv6 HTTPS check not runAAAA lookup and the IPv6 handshake were skipped for a local hostname or a blocked address.
- Target is an IPv6 addressThe scanned host is already an IPv6 address.
- No IPv6 (AAAA) addressDNS did not return an AAAA record for the host.
- IPv6 HTTPS handshake failedAn AAAA record exists, but the HTTPS handshake to that address failed.
- HTTPS available over IPv6The host has an AAAA record and completed an HTTPS handshake on IPv6.
Headers
- Strict-Transport-Security (HSTS) is presentThe response includes Strict-Transport-Security, so browsers can be told to stay on HTTPS for this host.
- Missing Strict-Transport-Security (HSTS)The response did not include Strict-Transport-Security.
- Content-Security-Policy (CSP) is presentThe response includes an enforcing Content-Security-Policy.
- Missing Content-Security-Policy (CSP)The response did not include an enforcing Content-Security-Policy.
- X-Frame-Options is presentThe response includes X-Frame-Options.
- Missing X-Frame-OptionsThe response did not include X-Frame-Options.
- X-Content-Type-Options is presentThe response includes X-Content-Type-Options.
- Missing X-Content-Type-OptionsThe response did not include X-Content-Type-Options.
- Referrer-Policy is presentThe response includes Referrer-Policy.
- Missing Referrer-PolicyThe response did not include Referrer-Policy.
- Permissions-Policy is presentThe response includes Permissions-Policy.
- Missing Permissions-PolicyThe response did not include Permissions-Policy.
- Cross-Origin-Opener-Policy (COOP) is presentThe response includes Cross-Origin-Opener-Policy.
- Missing Cross-Origin-Opener-Policy (COOP)The response did not include Cross-Origin-Opener-Policy.
- Cross-Origin-Resource-Policy (CORP) is presentThe response includes Cross-Origin-Resource-Policy.
- Missing Cross-Origin-Resource-Policy (CORP)The response did not include Cross-Origin-Resource-Policy.
- Cross-Origin-Embedder-Policy (COEP) is presentThe response includes Cross-Origin-Embedder-Policy.
- Missing Cross-Origin-Embedder-Policy (COEP)The response did not include Cross-Origin-Embedder-Policy.
- HSTS disabled via max-age=0Strict-Transport-Security is present with max-age=0, which tells browsers to forget HSTS for this host.
- HSTS max-age is too shortHSTS max-age is below 180 days (15552000 seconds). This scan flags anything shorter than that.
- HSTS max-age acceptableHSTS max-age is at least 180 days.
- HSTS missing max-ageStrict-Transport-Security is present but has no max-age directive, so browsers ignore it as HSTS.
- HSTS includes subdomainsThe HSTS header includes includeSubDomains, so the HTTPS-only rule covers hosts under this name.
- HSTS does not include subdomainsHSTS is set for this host only. Subdomains are not covered.
- HSTS preload is setThe HSTS header includes the preload directive. That is a request to be hardcoded as HTTPS-only in browsers.
- HSTS preload check not runThe public preload list was not queried because the target is a local hostname.
- Domain is on the HSTS preload listChromium's public HSTS preload list already includes this domain.
- HSTS header looks preload-readyThe header has preload, includeSubDomains, and a one-year max-age, but the public list does not show the domain as preloaded.
- HSTS preload list statusThe public preload list reports this domain as pending or rejected.
- CSP allows unsafe-inlineContent-Security-Policy includes 'unsafe-inline', so the browser may run inline scripts or styles.
- CSP allows unsafe-evalContent-Security-Policy includes 'unsafe-eval', so eval() and similar string-to-code APIs are allowed.
- CSP missing default-srcThe policy has no default-src fallback.
- CSP missing script-srcScripts fall back to default-src because script-src and script-src-elem are absent.
- CSP missing object-srcThe policy does not set object-src.
- CSP missing base-uriThe policy does not set base-uri.
- CSP missing form-actionThe policy does not set form-action.
- CSP missing upgrade-insecure-requestsThe policy does not include upgrade-insecure-requests.
- CSP missing frame-ancestorsThe policy does not set frame-ancestors.
- CSP enables Trusted TypesThe policy includes require-trusted-types-for, so DOM XSS sinks must receive a trusted type instead of a raw string.
- CSP allows a wildcard sourceThe policy allows * as a source, so that resource type can load from any host.
- CSP allows data:The policy allows data: for a script or object source.
- CSP allows blob:The policy allows blob: as a source.
- CSP is report-only and not enforcedContent-Security-Policy-Report-Only is present and there is no enforcing Content-Security-Policy.
- Referrer-Policy is unsafeReferrer-Policy is an unsafe value that can send the full URL on cross-origin requests.
- Referrer-Policy is weakReferrer-Policy is set, but the value is weaker than the ones this scan treats as safe.
- X-Frame-Options is obsoleteX-Frame-Options uses a value browsers no longer honor, such as ALLOW-FROM.
- X-Frame-Options is invalidX-Frame-Options is present but is not DENY or SAMEORIGIN.
- COOP is unsafe-noneCross-Origin-Opener-Policy is unsafe-none, which is the same as leaving the browsing context shared.
- COOP value is unrecognizedCross-Origin-Opener-Policy is set to a value this scan does not treat as an isolating policy.
- Permissions-Policy allows any originPermissions-Policy grants at least one feature to * , so every origin may use it.
- HTTP/3 advertisedAlt-Svc advertises HTTP/3 (h3).
- Alternative service advertisedAlt-Svc is present but does not advertise HTTP/3.
- Reporting endpoints configuredThe response publishes Reporting-Endpoints, Report-To, or NEL.
- Timing-Allow-Origin is a wildcardTiming-Allow-Origin is *, so any site can read detailed timing for this response.
- Server-Timing header exposedThe response includes Server-Timing.
TLS
- TLS handshake failedThe scanner could not complete a TLS handshake with the host.
- TLS connection failedThe TCP connection used for TLS could not be established.
- Target is not HTTPSThe scanned URL is not https, so there is no TLS certificate to inspect.
- TLS certificate expiredThe certificate's notAfter date is in the past.
- TLS certificate expiredThe handshake failed because the certificate is already expired.
- Certificate is not yet validThe certificate's notBefore date is still in the future.
- TLS certificate expiring soonThe certificate is still valid, but its end date is close.
- TLS certificate validity OKThe certificate is inside its validity window and is not close to expiry.
- Certificate matches hostnameA DNS name on the certificate matches the host that was scanned.
- Certificate does not match hostnameNone of the certificate's DNS names match the scanned host.
- Certificate hostname mismatchThe handshake reported that the certificate name does not match the host.
- Certificate is missing SANsThe certificate has no Subject Alternative Name extension.
- Certificate has no DNS namesThe certificate does not list any DNS names to compare with the host.
- Wildcard certificate observedThe matching name is a wildcard, such as *.example.com.
- Self-signed certificateThe certificate subject and issuer are the same, so it is self-signed.
- Self-signed certificate is untrustedThe handshake failed because the certificate is self-signed or otherwise not trusted.
- Certificate chain is untrustedThe handshake could not build a chain to a trusted root.
- Certificate public key is shortThe certificate's RSA key is shorter than 2048 bits.
- Certificate uses a DSA keyThe certificate public key is DSA.
- Certificate key length is acceptableThe certificate key type and size look modern.
- Certificate uses a weak signatureThe certificate is signed with a weak hash, such as SHA-1 or MD5.
- Certificate Transparency SCTs presentThe certificate embeds Signed Certificate Timestamps.
- Certificate Transparency SCTs missingThe certificate itself does not contain Signed Certificate Timestamps.
- OCSP Must-Staple is setThe certificate requires a stapled OCSP response.
- Deprecated TLS protocolThe handshake negotiated a TLS version this scan treats as deprecated.
- TLS 1.3 negotiatedThe handshake used TLS 1.3.
- TLS protocol is acceptableThe negotiated protocol is acceptable, but it is not TLS 1.3.
- Weak TLS cipher negotiatedThe server selected a cipher whose name contains RC4, DES, NULL, EXPORT, ANON, or MD5.
- TLS cipher is acceptableThe negotiated cipher is not one of the weak names this scan flags.
- TLS key is shortThe negotiated cipher's secret is shorter than 128 bits.
- ALPN negotiated HTTP/2The TLS handshake selected HTTP/2 via ALPN.
- ALPN negotiated HTTP/1.1The TLS handshake selected HTTP/1.1 via ALPN.
- Certificate Transparency check not runcrt.sh was not queried because the target is a local hostname.
- Certificate Transparency lists extra namesPublic Certificate Transparency logs contain names related to this host that are not on the current certificate.
CORS
- No CORS headers exposedThe main response did not include Access-Control-Allow-Origin.
- CORS allows any origin with credentialsAccess-Control-Allow-Origin is * and Access-Control-Allow-Credentials is true.
- CORS reflects an untrusted OriginThe response copied the scanner's Origin, https://security-check.invalid, into Access-Control-Allow-Origin.
- CORS allows any originAccess-Control-Allow-Origin is *.
- CORS restricted to a specific originAccess-Control-Allow-Origin names a specific origin rather than * or the probe origin.
- CORS allows all methodsAccess-Control-Allow-Methods includes a wildcard.
Redirects
- No redirect chainThe response was returned without intermediate redirects.
- Redirect chain exceeds the limitThe scanner followed more redirects than its configured limit.
- Unusual redirect status codeA hop in the chain used a status this scan does not treat as a normal redirect (301, 302, 303, 307, or 308).
- Redirect chain downgrades to HTTPAt least one hop moves from an HTTPS URL to an HTTP Location.
- Cross-domain redirects detectedA hop's host is not the host of the final URL.
- Potential open redirect patternA Location header contains a parameter name often used for open redirects, such as url, redirect, next, return, continue, dest, or destination.
- Redirect chain looks acceptableThe scanner followed one or more redirects and did not flag a downgrade or an over-long chain.
DNS
- DNS email checks not applicableSPF, DMARC, CAA, DNSSEC, MTA-STS, TLS-RPT, and DKIM were not looked up because the host is local.
- SPF record not foundNo TXT record starting with v=spf1 was found for the domain.
- SPF record foundThe domain publishes a single SPF record and this scan did not flag it as overly broad.
- Multiple SPF records foundMore than one TXT record starts with v=spf1.
- SPF record is overly permissiveThe SPF record uses a mechanism that allows any sender, such as +all.
- SPF uses the ptr mechanismThe SPF record includes the ptr mechanism.
- SPF exceeds the 10 DNS-lookup limitEvaluating the SPF record needs more than 10 DNS lookups.
- DMARC record not foundNo DMARC TXT record was found at _dmarc for this domain.
- DMARC record foundA DMARC record is published and was not flagged for a none policy or a missing aggregate address.
- DMARC policy is noneThe DMARC record sets p=none.
- DMARC missing aggregate reportingThe DMARC record has no rua address.
- DMARC applies to only part of mailThe DMARC pct tag is set below 100.
- DMARC subdomain policy is noneThe DMARC sp tag is none, so subdomains are not covered by a stricter policy.
- CAA lookup unavailableThe CAA query did not return a usable answer.
- CAA records not foundThe domain has no CAA records.
- CAA records foundCAA records are published for the domain.
- CAA missing iodef contactCAA records exist but none is an iodef contact.
- DNSSEC chain validatedA validating resolver accepted the DNSSEC chain for this name.
- DNSSEC validation failedA validating resolver rejected the DNSSEC chain.
- DNSSEC records are incompleteSome DNSSEC records are present, but the chain did not validate.
- DNSSEC not detectedThis scan did not see a validating DNSSEC chain for the name.
- MTA-STS record not foundNo MTA-STS TXT record was found.
- MTA-STS record foundAn MTA-STS TXT record is published.
- MTA-STS policy check not runThe policy file was not fetched because the host is local.
- MTA-STS policy file missinghttps://mta-sts.<domain>/.well-known/mta-sts.txt was not a published policy.
- MTA-STS policy host unreachableThe scanner could not fetch the MTA-STS policy host.
- MTA-STS policy is not STSv1The policy file was fetched but it is not a version STSv1 policy.
- MTA-STS policy enforces TLSThe policy mode is enforce.
- MTA-STS policy is not enforceThe policy was published with a mode other than enforce, such as testing or none.
- MTA-STS policy publishedA policy file was found at the well-known MTA-STS URL.
- TLS-RPT record not foundNo TLS-RPT TXT record was found.
- TLS-RPT record foundA TLS-RPT record is published.
- DKIM selector foundA common DKIM selector answered with a v=DKIM1 key.
- No common DKIM selectors foundNone of google, selector1, selector2, default, s1, or k1 published v=DKIM1.
HTML
- Active mixed contentThis HTTPS page's HTML loads a script, frame, or form action over HTTP.
- Passive mixed contentThis HTTPS page's HTML loads an image, stylesheet, or media file over HTTP.
- No mixed content in page HTMLThe HTML this scan fetched does not reference HTTP subresources from an HTTPS page.
- Third-party assets missing Subresource IntegrityA cross-origin script or stylesheet in the HTML has no integrity hash.
- Third-party assets use Subresource IntegrityCross-origin scripts and stylesheets in the HTML include integrity hashes.
Disclosure
- Information disclosure via ServerThe response includes Server, which names part of the stack.
- Information disclosure via X-Powered-ByThe response includes X-Powered-By, which names part of the stack.
- Information disclosure via X-AspNet-VersionThe response includes X-AspNet-Version, which names part of the stack.
- Information disclosure via X-GeneratorThe response includes X-Generator, which names part of the stack.
- No common disclosure headersServer, X-Powered-By, X-AspNet-Version, and X-Generator were not on the response.
- robots.txt lists sensitive pathsrobots.txt mentions a path such as /admin, /wp-admin, /.env, /backup, /phpmyadmin, or /server-status.
- change-password URL published/.well-known/change-password answered successfully.
- Apple App Site Association is emptyapple-app-site-association is reachable but has no applinks details.
- Apple App Site Association publishedThe association file includes applinks details.
- assetlinks.json is empty/.well-known/assetlinks.json exists but contains no statements.
- Android assetlinks.json publishedassetlinks.json contains statements.
- OpenAPI or Swagger document is public /openapi.json or /swagger.json is reachable and describes an API.
- security.txt not reachableThe scanner could not fetch /.well-known/security.txt.
- security.txt not found/.well-known/security.txt returned 404.
- security.txt returned an error/.well-known/security.txt answered with an HTTP error other than 404.
- security.txt missing Contactsecurity.txt is present but has no Contact field.
- security.txt contact publishedsecurity.txt includes a Contact field.
- security.txt Expires is presentsecurity.txt has an Expires value this scan could parse.
- security.txt Expires is invalidExpires is present but not a date this scan recognizes.
- security.txt published/.well-known/security.txt is available.