- Scan ID:
- 8f0cc500-2523-4b38-8795-b793eeac89afFinished
- Submitted URL:
- https://freepro.comRedirected
- Report Finished:
Risks · 0 found
Practices that may pose security risks
Security Headers · 10 found
HTTP response headers that can harden the security of a web application
Learn more...Name | Value | Support | Info |
---|---|---|---|
Strict-Transport-Security | max-age=31536000; includeSubdomains; preload | Good | Declare that a website is only accessible over a secure connection (HTTPS). Click to learn more... |
X-Frame-Options | SAMEORIGIN | Good | Indicate whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>. Click to learn more... |
X-Content-Type-Options | nosniff | Good | Indicate that the MIME types advertised in the Content-Type headers should be followed and not be changed. Click to learn more... |
Content-Security-Policy | upgrade-insecure-requests | Good | Control resources the user agent is allowed to load for a given page. Click to learn more... |
Referrer-Policy | strict-origin-when-cross-origin | Good | Control how much referrer information should be included with requests. Click to learn more... |
Clear-Site-Data | — | Good | Control the data stored by a client browser for their origins. Click to learn more... |
X-Permitted-Cross-Domain-Policies | none | Good | Control whether a web client such as Adobe Flash Player or Adobe Acrobat has permission to handle data across domains. Click to learn more... |
Permissions-Policy | accelerometer=(self); ambient-light-sensor=(self); autoplay=(self); battery=(self); camera=(self); display-capture=(self); document-domain=*; encrypted-media=(self); execution-while-not-rendered=*; execution-while-out-of-viewport=*; fullscreen=(self); gamepad=(self); geolocation=(self); gyroscope=(self); hid=(self); identity-credentials-get=(self); idle-detection=(self); layout-animations=(self); legacy-image-formats=(self); local-fonts=(self); magnetometer=(self); microphone=(self); midi=(self); navigation-override=(self); oversized-images=(self); payment=(self); picture-in-picture=*; publickey-credentials-create=(self); publickey-credentials-get=(self); screen-wake-lock=(self); serial=(self); speaker-selection=(self); storage-access=*; sync-xhr=*; unoptimized-images=*; unsized-media=*; usb=(self); web-share=(self); xr-spatial-tracking=(self) | New | Allow and deny the use of browser features in a document or iframe. Click to learn more... |
Cross-Origin-Embedder-Policy | — | New | Configure embedding cross-origin resources into the document. Click to learn more... |
Cross-Origin-Opener-Policy | — | New | Ensure a top-level document does not share a browsing context group with cross-origin documents. Click to learn more... |
Cross-Origin-Resource-Policy | — | New | Request that the browser blocks no-cors cross-origin/cross-site requests to the given resource. Click to learn more... |
X-XSS-Protection | 1; mode=block | Deprecated | Deprecated. Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. Click to learn more... |
Feature-Policy | accelerometer 'self'; ambient-light-sensor 'self'; autoplay 'self'; battery 'self'; camera 'self'; display-capture 'self'; document-domain *; encrypted-media 'self'; execution-while-not-rendered *; execution-while-out-of-viewport *; fullscreen 'self'; gamepad 'self'; geolocation 'self'; gyroscope 'self'; hid 'self'; identity-credentials-get 'self'; idle-detection 'self'; layout-animations 'self'; legacy-image-formats 'self'; local-fonts 'self'; magnetometer 'self'; microphone 'self'; midi 'self'; navigation-override 'self'; oversized-images 'self'; payment 'self'; picture-in-picture *; publickey-credentials-create 'self'; publickey-credentials-get 'self'; screen-wake-lock 'self'; serial 'self'; speaker-selection 'self'; storage-access *; sync-xhr *; unoptimized-images *; unsized-media *; usb 'self'; web-share 'self'; xr-spatial-tracking 'self'; | Deprecated | Deprecated. Replaced by the Permissions-Policy header. Click to learn more... |
Expect-CT | enforce; max-age=604800 | Deprecated | Deprecated. Opt in to reporting and/or enforcement of Certificate Transparency requirements. Click to learn more... |
Public-Key-Pins | — | Deprecated | Deprecated. Allows HTTPS websites to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates. Click to learn more... |
Security Violations · 0 found
Requests or resources offending security policies
Certificates · 3 found
SSL/TLS Certificates enable websites to encrypt transactions between the client and the server and provide server identity verification
Subject | Issue date | Expiry date |
---|---|---|
*.freepro.com | Nov 30, 2023, 00:00:00 | Nov 23, 2024, 23:59:59 |
*.wp.com | Nov 28, 2023, 00:00:00 | Dec 28, 2024, 23:59:59 |
*.privacy-center.org | Mar 10, 2024, 00:00:00 | Apr 7, 2025, 23:59:59 |