dmosk / sitechecker

← Kontrole dön

sitechecker — örnek rapor

Static demo of a level-1 report for example.com. No live scan is run on this page.

Rapor

example.com · 18420 ms · seviye 1

Not

C

Puan

71

Orta — belirgin boşluklar var, yakında düzeltin.

Üç ana düzeltme

  1. HSTS is missing or too weak — yüksek (H1)
  2. Cookies without the Secure flag — yüksek (C1)
  3. MIME sniffing is not blocked — orta (H4)
HSTS is missing or too weak H1 hata

Neden önemli: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

Nasıl düzeltilir

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 hata

Neden önemli: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

Nasıl düzeltilir

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 ok

Neden önemli: Users who open http:// can stay on an unencrypted connection.

Nasıl düzeltilir

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 hata

Neden önemli: Session cookies without Secure can be sent over plain HTTP and stolen.

Nasıl düzeltilir

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 uyarı

Neden önemli: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

Nasıl düzeltilir

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 bilgi

Neden önemli: Researchers have no clear place to report vulnerabilities (RFC 9116).

Nasıl düzeltilir

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

Yalnızca pasif kontroller (seviye 1 ve isteğe bağlı sahip seviye 2) — bu rapor sitenin güvenli olduğu anlamına gelmez.