The server negotiates TLS 1.0 or 1.1, which have known weaknesses and are disabled by modern browsers.

TLSv1.0

The certificate is self-signed (issuer == subject), so browsers will warn users the connection is untrusted.

The certificate expired on Fri, 26 Jun 2026 19:18:48 GMT. Browsers will block the site.

valid_to: Fri, 26 Jun 2026 19:18:48 GMT

A string matching a known credential pattern was found in the public HTML. Page source is visible to everyone, so this is effectively a leaked secret.

Strict-Transport-Security (HSTS) is missing. Without it, a user on a hostile network can be silently redirected to an insecure (HTTP) version of your site on their first request.

CSP is the strongest defense against cross-site scripting (XSS) and data injection. Without it, the browser will run any script the page serves, including attacker-injected ones.

Without clickjacking protection, your site can be embedded invisibly by another site and trick users into clicking hidden actions.

Without `nosniff`, browsers may guess (sniff) a file's type and execute an upload as a script.

Without an SPF (Sender Policy Framework) record, scammers can send email that appears to come from your domain.

DMARC tells receivers what to do with email that fails SPF/DKIM. Without it, spoofed mail is usually still delivered.

A cookie was set without the Secure, HttpOnly, SameSite flags, which can expose it to theft (over HTTP) or cross-site delivery (CSRF).

session=abc123; Path=/

The page loads images, scripts, or stylesheets over plain HTTP (mixed content). Browsers may block these or show a security warning.

The full URL (including query strings) may be leaked to other sites when users follow links.

The `Server`/`X-Powered-By` header advertises your stack and version, which makes targeted attacks easier.

nginx/1.18.0 (Ubuntu)

DKIM cryptographically signs outgoing mail. None was found at the common `default._domainkey` selector — a custom selector may still exist.