dmosk / sitechecker

← Retour au contrôle

sitechecker — exemple de rapport

Static demo of a level-1 report for example.com. No live scan is run on this page.

Rapport

example.com · 18420 ms · niveau 1

Note

C

Score

71

Moyen — des écarts notables, à corriger bientôt.

Trois corrections prioritaires

  1. HSTS is missing or too weak — élevé (H1)
  2. Cookies without the Secure flag — élevé (C1)
  3. MIME sniffing is not blocked — moyen (H4)
HSTS is missing or too weak H1 échec

Pourquoi c’est important: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

Comment corriger

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 échec

Pourquoi c’est important: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

Comment corriger

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 ok

Pourquoi c’est important: Users who open http:// can stay on an unencrypted connection.

Comment corriger

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 échec

Pourquoi c’est important: Session cookies without Secure can be sent over plain HTTP and stolen.

Comment corriger

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 alerte

Pourquoi c’est important: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

Comment corriger

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 info

Pourquoi c’est important: Researchers have no clear place to report vulnerabilities (RFC 9116).

Comment corriger

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

Contrôles passifs uniquement (niveau 1 et niveau 2 optionnel du propriétaire) — le rapport ne signifie pas que le site est sûr.