dmosk / sitechecker

← チェックに戻る

sitechecker — レポート例

Static demo of a level-1 report for example.com. No live scan is run on this page.

レポート

example.com · 18420 ms · レベル1

評価

C

スコア

71

普通 — 目立った不足あり。早めに直しましょう。

優先すべき3つの修正

  1. HSTS is missing or too weak — 高 (H1)
  2. Cookies without the Secure flag — 高 (C1)
  3. MIME sniffing is not blocked — 中 (H4)
HSTS is missing or too weak H1 失敗

なぜ重要か: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

修正方法

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 失敗

なぜ重要か: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

修正方法

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 ok

なぜ重要か: Users who open http:// can stay on an unencrypted connection.

修正方法

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 失敗

なぜ重要か: Session cookies without Secure can be sent over plain HTTP and stolen.

修正方法

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 警告

なぜ重要か: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

修正方法

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 情報

なぜ重要か: Researchers have no clear place to report vulnerabilities (RFC 9116).

修正方法

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

受動チェックのみ（レベル1と所有者限定のレベル2）— 本レポートはサイトが安全であることを意味しません。