dmosk / sitechecker

← Volver al comprobador

sitechecker — informe de ejemplo

Static demo of a level-1 report for example.com. No live scan is run on this page.

Informe

example.com · 18420 ms · nivel 1

Nota

C

Puntuación

71

Regular — hay huecos notables; conviene corregir pronto.

Tres correcciones principales

  1. HSTS is missing or too weak — alta (H1)
  2. Cookies without the Secure flag — alta (C1)
  3. MIME sniffing is not blocked — media (H4)
HSTS is missing or too weak H1 fallo

Por qué importa: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

Cómo corregir

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 fallo

Por qué importa: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

Cómo corregir

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 ok

Por qué importa: Users who open http:// can stay on an unencrypted connection.

Cómo corregir

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 fallo

Por qué importa: Session cookies without Secure can be sent over plain HTTP and stolen.

Cómo corregir

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 aviso

Por qué importa: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

Cómo corregir

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 info

Por qué importa: Researchers have no clear place to report vulnerabilities (RFC 9116).

Cómo corregir

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

Solo comprobaciones pasivas (nivel 1 y nivel 2 opcional del propietario): el informe no significa que el sitio sea seguro.