Fixes
Every problem we check for, and how to fix it
Each page says what the problem is in everyday words, gives you a message to paste into your AI tool, and has the exact settings if you'd rather do it yourself.
Fix now
Someone could use this against your site or your users today.
- CriticalSecret key in your front endA secret API key in your JavaScript bundle is readable by anyone. How to rotate it, move the call server side, and check your build is clean.
- CriticalPublic .env fileIf yoursite.com/.env downloads, every secret in it is compromised. Block the path, rotate the keys, and keep env files out of your deploy.
- HighPublic .git folderA public /.git folder lets anyone rebuild your source code and history, secrets included. How to block it and check what already leaked.
- HighPublic config.json with credentialsA config.json served from your site with keys or passwords in it is readable by anyone. How to remove it, rotate the values, and verify.
- HighCORS reflects any origin with credentialsIf your API echoes any Origin and allows credentials, other sites can read logged in users' data. How to use a real allowlist instead.
- HighNo http to https redirectIf http:// still loads your site, visitors on public wifi can be read or tampered with. How to force a 301 to https on Vercel, Netlify or nginx.
Fix soon
Nothing is open right now, but a standard protection is missing.
- MediumMissing HSTS headerNo Strict-Transport-Security header means browsers may try http first. The exact HSTS header to add in Next.js, Vercel, Netlify or nginx.
- MediumMissing Content Security PolicyNo Content-Security-Policy means injected scripts run freely. A starter CSP for Next.js and Vercel, and how to roll it out without breaking things.
- MediumClickjacking protection missingWithout X-Frame-Options or frame-ancestors, other sites can frame your pages and trick clicks. The one header to add, per platform.
- LowHSTS max-age too shortAn HSTS max-age under six months expires between visits and gives little protection. The recommended value and how to change it.
- LowWeak Content Security PolicyA CSP with 'unsafe-inline' or broad hosts in script-src doesn't stop injected scripts. How to move to nonces and 'strict-dynamic' safely.
- LowMissing X-Content-Type-OptionsWithout X-Content-Type-Options: nosniff, browsers may guess file types and run uploads as scripts. The one line header fix per platform.
- LowCookie without Secure flagA cookie without the Secure flag can travel over plain http. How to set Secure, HttpOnly and SameSite in Express, Next.js and raw headers.
- LowSession cookie without HttpOnlyA session cookie without HttpOnly can be stolen by any script on your page. How to set HttpOnly in Express, Next.js and plain headers.
- LowCORS wildcard with credentialsAccess-Control-Allow-Origin * together with credentials is rejected by browsers. What it means and the correct CORS setup for your case.
- LowServer version disclosureHeaders like X-Powered-By and Server: nginx/1.18 tell scanners what to try. How to remove them in Next.js, Express, nginx and PHP.
Good to know
Not a problem on its own. Worth a quick look.
- InfoNo Referrer-PolicyNo Referrer-Policy header? Browsers already default to a safe value, so this is hardening. The recommended setting and how to add it.
- InfoGoogle API key restrictionsGoogle Maps and Firebase keys are meant to be public, but only safe with restrictions. How to lock a key to your domain and APIs.
Some of these can land in a different group on your report. A version number in a server name, for example, matters more than the server name alone. Your report always shows where each one landed for your site.