dmosk / sitechecker

← 返回检查

sitechecker — 示例报告

Static demo of a level-1 report for example.com. No live scan is run on this page.

报告

example.com · 18420 ms · 一级

评级

C

分数

71

一般 — 有明显缺口，建议尽快修复。

三项优先修复

  1. HSTS is missing or too weak — 高 (H1)
  2. Cookies without the Secure flag — 高 (C1)
  3. MIME sniffing is not blocked — 中 (H4)
HSTS is missing or too weak H1 失败

为什么重要: Without a strong Strict-Transport-Security header, browsers may keep using plain HTTP after the first visit and open the door to interception.

如何修复

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
MIME sniffing is not blocked H4 失败

为什么重要: Without X-Content-Type-Options: nosniff the browser may treat a file as a different type than the server intended.

如何修复

add_header X-Content-Type-Options "nosniff" always;
HTTP does not redirect to HTTPS T1 通过

为什么重要: Users who open http:// can stay on an unencrypted connection.

如何修复

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).
Cookies without the Secure flag C1 失败

为什么重要: Session cookies without Secure can be sent over plain HTTP and stolen.

如何修复

Mark session cookies Secure in the application cookie API.
DMARC is missing or too weak D3 警告

为什么重要: Without DMARC policy receivers do not know whether to reject forged mail from your domain.

如何修复

Add _dmarc TXT with v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
security.txt is missing F7 信息

为什么重要: Researchers have no clear place to report vulnerabilities (RFC 9116).

如何修复

Publish /.well-known/security.txt with Contact and Expires (RFC 9116).

仅为被动检查（一级与可选的所有者二级）——本报告并不表示网站是安全的。