HTTPS, security headers, mixed content, and access controls.
16 issuesbelow — sorted by severity, with the critical and high-severity ones first because they're what you should fix this week. Each entry links to a single page with the symptom, the root cause, the actual code or config change to ship, and a free scan that checks if the issue applies to your site right now.
Some cookies lack Secure or HttpOnly flags, exposing them to interception or JavaScript access.
HTTPS pages that load resources (like images, scripts, or stylesheets) over HTTP create mixed content. This undermines security, can break page functionality, a
Missing recommended HTTP security headers leaves your site vulnerable to a range of attacks, including clickjacking, MIME-sniffing, and cross-site scripting (XS
Sensitive URLs such as admin panels, configuration files, or backup directories are accessible to the public and return HTTP 200, indicating they are not proper
Your Content Security Policy allows unsafe-inline or unsafe-eval, exposing your site to XSS attacks and negating CSP protection.
Cross-origin iframes without a sandbox attribute can expose your site to security risks and supply-chain attacks.
External links with target="_blank" must include rel="noopener noreferrer" to prevent security risks like tabnapping.
Strict-Transport-Security max-age is set below 1 year, reducing HTTPS security and HSTS preload eligibility.
Server response headers reveal software version, increasing security risk through information disclosure.
Your website's SSL certificate is set to expire in 49 days. Timely renewal is essential to prevent browsers from displaying security warnings, which can deter u
Your website's SSL certificate will expire in 53 days. You must renew it to maintain secure HTTPS connections and avoid browser security warnings.
Your website's SSL certificate will expire in 59 days. Take action now to renew it and avoid security warnings, loss of user trust, and SEO penalties.
One or more external scripts are loaded without a Subresource Integrity (SRI) hash, exposing users to supply-chain attacks.
The Permissions-Policy HTTP header is missing, allowing unrestricted access to sensitive browser APIs.
The X-Powered-By HTTP header reveals backend technology, increasing risk of targeted attacks.