Vulnerability Scan

Security vulnerabilities and misconfiguration detection

3 Medium-Risk Vulnerabilities Detected

Your domain has some security issues that should be addressed. No critical vulnerabilities found.

0
Critical Issues
No Critical Threats
3
Medium Risk
+1 from last scan
5
Low Risk / Info
-2 from last scan
12
Tests Passed
80% Pass Rate

Detected Vulnerabilities

SeverityVulnerabilityCategoryStatusAction
MediumMissing Security Headers
X-Frame-Options and X-Content-Type-Options headers not set
HTTP SecurityOpen
MediumWeak SSL/TLS Configuration
TLS 1.0 and 1.1 still enabled on server
EncryptionOpen
MediumDirectory Listing Enabled
/uploads/ directory allows browsing of files
ConfigurationOpen
LowServer Version Disclosure
Server header reveals software version information
Information LeakOpen
LowMissing Referrer-Policy
No Referrer-Policy header configured
PrivacyOpen

Vulnerability Scan Categories

SSL/TLS Configuration
Passed

Certificate valid, HTTPS enforced

Security Headers
Needs Attention

Missing critical security headers

Authentication
Secure

Strong password policies enforced

Information Disclosure
Minor Issues

Some version info exposed

Injection Vulnerabilities
Protected

No SQL injection or XSS found

Server Configuration
Review Needed

Some misconfigurations detected

How to Add Security Headers

  1. Access your web server configuration file (Apache: .htaccess or httpd.conf, Nginx: nginx.conf).
  2. Add the following security headers to protect against common attacks:
    # Apache
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
  3. For Nginx, use the add_header directive:
    # Nginx
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
  4. If using a CDN or cloud service (Cloudflare, AWS), configure headers through their dashboard.
  5. Test your headers using securityheaders.com or similar tools.
  6. Restart your web server to apply the changes.

Security Headers Explained

Security Best Practices