dmosk / sitechecker

← Back to checker

sitechecker — sample report

Static demo of a level-1 report for example.com. No live scan is run on this page.

Report

example.com · 18420 ms · level 1

Grade

C

Score

71

Fair — notable gaps, worth fixing soon.

Top three fixes

  1. HSTS is missing or too weak — high (H1)
  2. Cookies without the Secure flag — high (C1)
  3. MIME sniffing is not blocked — medium (H4)
HSTS is missing or too weak H1 fail

Why it matters: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

How to fix

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 fail

Why it matters: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

How to fix

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 pass

Why it matters: Users who open http:// can stay on an unencrypted connection.

How to fix

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 fail

Why it matters: Session cookies without Secure can be sent over plain HTTP and stolen.

How to fix

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 warn

Why it matters: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

How to fix

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 info

Why it matters: Researchers have no clear place to report vulnerabilities (RFC 9116).

How to fix

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

Passive checks only (level 1 and optional owner-gated level 2) — this report does not mean the site is secure.