dmosk / sitechecker

← Zurück zum Check

sitechecker — Beispielbericht

Static demo of a level-1 report for example.com. No live scan is run on this page.

Bericht

example.com · 18420 ms · Stufe 1

Note

C

Punkte

71

Mittelmäßig — deutliche Lücken, bald beheben.

Drei wichtigste Fixes

  1. HSTS is missing or too weak — hoch (H1)
  2. Cookies without the Secure flag — hoch (C1)
  3. MIME sniffing is not blocked — mittel (H4)
HSTS is missing or too weak H1 fehler

Warum das wichtig ist: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

So beheben

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 fehler

Warum das wichtig ist: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

So beheben

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 ok

Warum das wichtig ist: Users who open http:// can stay on an unencrypted connection.

So beheben

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 fehler

Warum das wichtig ist: Session cookies without Secure can be sent over plain HTTP and stolen.

So beheben

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 warnung

Warum das wichtig ist: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

So beheben

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 info

Warum das wichtig ist: Researchers have no clear place to report vulnerabilities (RFC 9116).

So beheben

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

Nur passive Checks (Stufe 1 und optionale besitzergebundene Stufe 2) — der Bericht bedeutet nicht, dass die Seite sicher ist.