Security headers checker

{
  "url": "http://www.mozilla.org/",
  "finalUrl": "https://www.mozilla.org/",
  "status": 200,
  "https": true,
  "platform": "nginx",
  "hops": [
    {
      "url": "http://www.mozilla.org/",
      "status": 301,
      "ms": 21
    },
    {
      "url": "https://www.mozilla.org/",
      "status": 200,
      "ms": 97
    }
  ],
  "redirects": {
    "count": 1,
    "loop": false,
    "httpsUpgrade": true,
    "downgrade": false,
    "crossDomain": false,
    "chain": [
      {
        "from": "http://www.mozilla.org/",
        "to": "https://www.mozilla.org/",
        "status": 301
      }
    ]
  },
  "totalMs": 120,
  "grade": "C",
  "score": 65,
  "scoring": {
    "earned": 65,
    "penalty": 0
  },
  "checks": [
    {
      "id": "csp",
      "header": "Content-Security-Policy",
      "present": true,
      "rating": "weak",
      "weight": 25,
      "points": 6.3,
      "what": "Tells the browser which sources of scripts, styles, images and frames the page may use.",
      "why": "It is the strongest defence against cross-site scripting: an injected script is blocked unless the policy allows it.",
      "message": "A Content-Security-Policy is set, but it has 1 serious gap: see the CSP tab.",
      "value": "base-uri 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com google-analytics.com googletagmanager.com https://gtm.mozilla.org js.stripe.com s.ytimg.com tagmanager.google.com www.mozilla.org www.youtube.com; img-src 'self' blog.mozilla.org data: https://gtm.mozilla.org images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org; connect-src 'self' *.analytics.google.com *.google-analytics.com *.googletagmanager.com analytics.google.com google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execut…"
    },
    {
      "id": "hsts",
      "header": "Strict-Transport-Security",
      "present": true,
      "rating": "good",
      "weight": 20,
      "points": 20,
      "what": "Tells browsers to use HTTPS for this site, and optionally its subdomains, for a set time.",
      "why": "It stops downgrade attacks and removes the unprotected first request over plain HTTP on repeat visits.",
      "message": "HSTS is on for 365 days; includeSubDomains is not set (add it once every subdomain works over HTTPS); preload is not set (optional).",
      "value": "max-age=31536000"
    },
    {
      "id": "frame-protection",
      "header": "X-Frame-Options or frame-ancestors",
      "present": true,
      "rating": "good",
      "weight": 12,
      "points": 12,
      "what": "Controls which sites may put the page inside a frame.",
      "why": "Without it another site can overlay your page invisibly and trick people into clicking (clickjacking).",
      "message": "Framing is limited by the CSP frame-ancestors directive, which replaces X-Frame-Options in current browsers.",
      "value": "frame-ancestors 'none'"
    },
    {
      "id": "content-type-options",
      "header": "X-Content-Type-Options",
      "present": true,
      "rating": "good",
      "weight": 12,
      "points": 12,
      "what": "Tells browsers to trust the declared Content-Type instead of guessing.",
      "why": "It stops a browser deciding that an uploaded file is really a script and running it.",
      "message": "MIME sniffing is disabled.",
      "value": "nosniff"
    },
    {
      "id": "referrer-policy",
      "header": "Referrer-Policy",
      "present": true,
      "rating": "good",
      "weight": 11,
      "points": 11,
      "what": "Controls how much of the page address is sent in the Referer header when someone follows a link or loads a resource.",
      "why": "Full addresses can contain tokens, search terms or private paths that other sites should not see.",
      "message": "strict-origin-when-cross-origin keeps full URLs from leaking to other sites.",
      "value": "strict-origin-when-cross-origin"
    },
    {
      "id": "permissions-policy",
      "header": "Permissions-Policy",
      "present": false,
      "rating": "missing",
      "weight": 10,
      "points": 0,
      "what": "Switches browser features such as the camera, microphone and location on or off for the page and its frames.",
      "why": "It limits what a compromised script or an embedded third party can ask for.",
      "message": "No Permissions-Policy: powerful browser features stay available to any embedded content.",
      "fix": {
        "header": "Permissions-Policy: camera=(), microphone=(), geolocation=()",
        "name": "Permissions-Policy",
        "value": "camera=(), microphone=(), geolocation=()",
        "snippet": "add_header Permissions-Policy \"camera=(), microphone=(), geolocation=()\" always;"
      }
    },
    {
      "id": "coop",
      "header": "Cross-Origin-Opener-Policy",
      "present": true,
      "rating": "good",
      "weight": 4,
      "points": 4,
      "what": "Puts the page in its own browsing context group, so windows opened from other sites cannot reach it.",
      "why": "It blocks some cross-window attacks and is one of the two headers that turn on cross-origin isolation.",
      "message": "Windows from other sites cannot reach this page (same-origin).",
      "value": "same-origin"
    },
    {
      "id": "coep",
      "header": "Cross-Origin-Embedder-Policy",
      "present": false,
      "rating": "missing",
      "weight": 3,
      "points": 0,
      "what": "Requires every cross-origin resource the page loads to opt in to being embedded.",
      "why": "With COOP it shields the page from side-channel leaks. It can break embeds that send no CORP or CORS headers, so test before you enforce it.",
      "message": "No Cross-Origin-Embedder-Policy. It is opt-in, and it breaks cross-origin embeds that do not send CORP or CORS headers, so add it only when you need cross-origin isolation.",
      "fix": {
        "header": "Cross-Origin-Embedder-Policy: require-corp",
        "name": "Cross-Origin-Embedder-Policy",
        "value": "require-corp",
        "snippet": "add_header Cross-Origin-Embedder-Policy \"require-corp\" always;"
      }
    },
    {
      "id": "corp",
      "header": "Cross-Origin-Resource-Policy",
      "present": false,
      "rating": "missing",
      "weight": 3,
      "points": 0,
      "what": "Says which sites may load this response, for example only the same site.",
      "why": "It keeps other sites from embedding your images, scripts and data, which closes a class of cross-site leaks.",
      "message": "No Cross-Origin-Resource-Policy. Other sites may embed this response unless something else stops them.",
      "fix": {
        "header": "Cross-Origin-Resource-Policy: same-origin",
        "name": "Cross-Origin-Resource-Policy",
        "value": "same-origin",
        "snippet": "add_header Cross-Origin-Resource-Policy \"same-origin\" always;"
      }
    }
  ],
  "extras": [],
  "duplicates": [],
  "csp": {
    "mode": "enforced",
    "policyCount": 1,
    "directives": [
      {
        "name": "base-uri",
        "sources": [
          "'none'"
        ]
      },
      {
        "name": "script-src",
        "sources": [
          "'self'",
          "'unsafe-eval'",
          "'unsafe-inline'",
          "*.google-analytics.com",
          "*.googletagmanager.com",
          "google-analytics.com",
          "googletagmanager.com",
          "https://gtm.mozilla.org",
          "js.stripe.com",
          "s.ytimg.com",
          "tagmanager.google.com",
          "www.mozilla.org",
          "www.youtube.com"
        ]
      },
      {
        "name": "img-src",
        "sources": [
          "'self'",
          "blog.mozilla.org",
          "data:",
          "https://gtm.mozilla.org",
          "images.ctfassets.net",
          "www.google-analytics.com",
          "www.googletagmanager.com",
          "www.mozilla.org"
        ]
      },
      {
        "name": "connect-src",
        "sources": [
          "'self'",
          "*.analytics.google.com",
          "*.google-analytics.com",
          "*.googletagmanager.com",
          "analytics.google.com",
          "google-analytics.com",
          "googletagmanager.com",
          "gtm.mozilla.org",
          "https://abdri3ttkb.execute-api.us-east-2.amazonaws.com",
          "https://accounts.firefox.com/",
          "https://basket.mozilla.org",
          "https://gtm.mozilla.org",
          "o1069899.ingest.sentry.io",
          "o1069899.sentry.io",
          "region1.google-analytics.com"
        ]
      },
      {
        "name": "default-src",
        "sources": [
          "'self'",
          "*.mozilla.org"
        ]
      },
      {
        "name": "frame-src",
        "sources": [
          "'self'",
          "accounts.firefox.com",
          "gtm.mozilla.org",
          "https://gtm.mozilla.org",
          "js.stripe.com",
          "www.google-analytics.com",
          "www.googletagmanager.com",
          "www.youtube.com"
        ]
      },
      {
        "name": "style-src",
        "sources": [
          "'self'",
          "'unsafe-inline'",
          "www.mozilla.org"
        ]
      },
      {
        "name": "frame-ancestors",
        "sources": [
          "'none'"
        ]
      },
      {
        "name": "object-src",
        "sources": [
          "'none'"
        ]
      },
      {
        "name": "media-src",
        "sources": [
          "'self'",
          "assets.mozilla.net",
          "videos.cdn.mozilla.net",
          "www.mozilla.org"
        ]
      },
      {
        "name": "font-src",
        "sources": [
          "'self'",
          "www.mozilla.org"
        ]
      },
      {
        "name": "upgrade-insecure-requests",
        "sources": []
      },
      {
        "name": "form-action",
        "sources": [
          "'self'",
          "https://abdri3ttkb.execute-api.us-east-2.amazonaws.com",
          "https://accounts.firefox.com/",
          "https://basket.mozilla.org"
        ]
      }
    ],
    "findings": [
      {
        "severity": "high",
        "code": "unsafe-inline",
        "message": "Scripts may be 'unsafe-inline': any script an attacker injects into the page will run.",
        "fix": "Remove 'unsafe-inline' and allow your inline scripts with a per-response nonce or a hash."
      },
      {
        "severity": "medium",
        "code": "wildcard-script-host",
        "message": "Script sources use a wildcard host (\"*.google-analytics.com\", \"*.googletagmanager.com\"): every subdomain is trusted, including ones you do not control.",
        "fix": "Name the specific hosts instead of a wildcard."
      },
      {
        "severity": "medium",
        "code": "unsafe-eval",
        "message": "Scripts may use 'unsafe-eval': eval() and similar calls can turn injected text into running code.",
        "fix": "Remove 'unsafe-eval' and replace eval-style code in your scripts or libraries."
      },
      {
        "severity": "low",
        "code": "style-unsafe-inline",
        "message": "Styles may be 'unsafe-inline'. That is a smaller risk than for scripts, but injected CSS can still leak page content."
      },
      {
        "severity": "info",
        "code": "upgrade-insecure-requests",
        "message": "upgrade-insecure-requests is set: mixed-content requests are upgraded to https."
      }
    ]
  },
  "cookies": [],
  "server": {
    "software": "granian",
    "cdn": "Fastly",
    "versionDisclosed": false
  },
  "headers": [
    {
      "name": "connection",
      "value": "close"
    },
    {
      "name": "content-length",
      "value": "8054"
    },
    {
      "name": "strict-transport-security",
      "value": "max-age=31536000"
    },
    {
      "name": "x-content-type-options",
      "value": "nosniff"
    },
    {
      "name": "x-backend-server",
      "value": "bedrock-79dc4bb4bd-d5pnx.gcp-eu-west1"
    },
    {
      "name": "expires",
      "value": "Sat, 14 Nov 2026 17:44:42 GMT"
    },
    {
      "name": "x-frame-options",
      "value": "DENY"
    },
    {
      "name": "via",
      "value": "1.1 google, 1.1 varnish, 1.1 varnish"
    },
    {
      "name": "content-security-policy-report-only",
      "value": "base-uri 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com google-analytics.com googletagmanager.com https://gtm.mozilla.org js.stripe.com s.ytimg.com tagmanager.google.com www.mozilla.org www.youtube.com; img-src 'self' blog.mozilla.org data: https://gtm.mozilla.org images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org; connect-src 'self' *.analytics.google.com *.google-analytics.com *.googletagmanager.com analytics.google.com google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org https://gtm.mozilla.org o1069899.ingest.sentry.io o1069899.sentry.io region1.google-analytics.com; default-src 'self' *.mozilla.org; frame-src 'self' accounts.firefox.com gtm.mozilla.org https://gtm.mozilla.org js.stripe.com www.google-analytics.com www.googletagmanager.com www.youtube.com; style-src 'self' 'unsafe-inline' www.mozilla.org; frame-ancestors 'none'; object-src 'none'; media-src 'self' assets.mozilla.net videos.cdn.mozilla.net www.mozilla.org; font-src 'self' www.mozilla.org; upgrade-insecure-requests; form-action 'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org"
    },
    {
      "name": "content-type",
      "value": "text/html; charset=utf-8"
    },
    {
      "name": "content-security-policy",
      "value": "base-uri 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com google-analytics.com googletagmanager.com https://gtm.mozilla.org js.stripe.com s.ytimg.com tagmanager.google.com www.mozilla.org www.youtube.com; img-src 'self' blog.mozilla.org data: https://gtm.mozilla.org images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org; connect-src 'self' *.analytics.google.com *.google-analytics.com *.googletagmanager.com analytics.google.com google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org https://gtm.mozilla.org o1069899.ingest.sentry.io o1069899.sentry.io region1.google-analytics.com; default-src 'self' *.mozilla.org; frame-src 'self' accounts.firefox.com gtm.mozilla.org https://gtm.mozilla.org js.stripe.com www.google-analytics.com www.googletagmanager.com www.youtube.com; style-src 'self' 'unsafe-inline' www.mozilla.org; frame-ancestors 'none'; object-src 'none'; media-src 'self' assets.mozilla.net videos.cdn.mozilla.net www.mozilla.org; font-src 'self' www.mozilla.org; upgrade-insecure-requests; form-action 'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org"
    },
    {
      "name": "cross-origin-opener-policy",
      "value": "same-origin"
    },
    {
      "name": "server",
      "value": "granian"
    },
    {
      "name": "etag",
      "value": "\"6084d2a6c126197371d3f4220c6f4575\""
    },
    {
      "name": "cache-control",
      "value": "max-age=600"
    },
    {
      "name": "referrer-policy",
      "value": "strict-origin-when-cross-origin"
    },
    {
      "name": "x-clacks-overhead",
      "value": "GNU Terry Pratchett"
    },
    {
      "name": "content-encoding",
      "value": "br"
    },
    {
      "name": "accept-ranges",
      "value": "bytes"
    },
    {
      "name": "age",
      "value": "583"
    },
    {
      "name": "date",
      "value": "Sat, 14 Nov 2026 17:44:25 GMT"
    },
    {
      "name": "x-served-by",
      "value": "cache-fra-eddf8230229-FRA, cache-fra-eddf8230229-FRA, cache-fra-etou8220186-FRA"
    },
    {
      "name": "x-cache",
      "value": "MISS, HIT"
    },
    {
      "name": "x-cache-hits",
      "value": "0, 0"
    },
    {
      "name": "x-timer",
      "value": "S1794678265.165023,VS0,VE27"
    },
    {
      "name": "vary",
      "value": "Accept-Language, Accept-Encoding"
    }
  ],
  "issues": [],
  "notes": [
    "Graded the final response, https://www.mozilla.org/. The redirect before it was not graded."
  ],
  "statusText": "OK"
}