dmosk / sitechecker

← Torna al controllo

sitechecker — esempio di report

Static demo of a level-1 report for example.com. No live scan is run on this page.

Report

example.com · 18420 ms · livello 1

Voto

C

Punteggio

71

Discreto — lacune evidenti, meglio correggere presto.

Tre correzioni principali

  1. HSTS is missing or too weak — alta (H1)
  2. Cookies without the Secure flag — alta (C1)
  3. MIME sniffing is not blocked — media (H4)
HSTS is missing or too weak H1 errore

Perché conta: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

Come correggere

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 errore

Perché conta: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

Come correggere

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 ok

Perché conta: Users who open http:// can stay on an unencrypted connection.

Come correggere

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 errore

Perché conta: Session cookies without Secure can be sent over plain HTTP and stolen.

Come correggere

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 avviso

Perché conta: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

Come correggere

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 info

Perché conta: Researchers have no clear place to report vulnerabilities (RFC 9116).

Come correggere

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

Solo controlli passivi (livello 1 e livello 2 opzionale del proprietario): il report non significa che il sito sia sicuro.