dmosk / sitechecker

← 검사로 돌아가기

sitechecker — 예시 보고서

Static demo of a level-1 report for example.com. No live scan is run on this page.

보고서

example.com · 18420 ms · 레벨 1

등급

C

점수

71

보통 — 눈에 띄는 빈틈이 있어 빨리 고치는 편이 좋습니다.

우선 수정 3가지

  1. HSTS is missing or too weak — 높음 (H1)
  2. Cookies without the Secure flag — 높음 (C1)
  3. MIME sniffing is not blocked — 보통 (H4)
HSTS is missing or too weak H1 실패

왜 중요한가: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

수정 방법

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 실패

왜 중요한가: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

수정 방법

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 통과

왜 중요한가: Users who open http:// can stay on an unencrypted connection.

수정 방법

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 실패

왜 중요한가: Session cookies without Secure can be sent over plain HTTP and stolen.

수정 방법

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 경고

왜 중요한가: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

수정 방법

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 정보

왜 중요한가: Researchers have no clear place to report vulnerabilities (RFC 9116).

수정 방법

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

수동 검사만(레벨 1 및 선택적 소유자 레벨 2). 이 보고서는 사이트가 안전하다는 뜻이 아닙니다.