sitechecker — नमूना रिपोर्ट

यह क्यों ज़रूरी है: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

यह क्यों ज़रूरी है: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

add_header X-Content-Type-Options "nosniff" always;

यह क्यों ज़रूरी है: Users who open http:// can stay on an unencrypted connection.

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

यह क्यों ज़रूरी है: Session cookies without Secure can be sent over plain HTTP and stolen.

Mark session cookies Secure in the application cookie API.

यह क्यों ज़रूरी है: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

यह क्यों ज़रूरी है: Researchers have no clear place to report vulnerabilities (RFC 9116).

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).