{
"url": "https://anasseo.godaddysites.com/f/bestwebssnews",
"score": 3,
"summary": {
"missing": 7,
"warnings": 3,
"notices": 6
},
"caches": [
"Website",
"Browser"
],
"headers": {
"vary": {
"value": "accept-encoding",
"findings": [
{
"severity": "info",
"message": "The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type."
}
]
},
"etag": {
"value": "8f6c300335b3cc2c9c041a5e040ee22c",
"findings": [
{
"severity": "info",
"message": "A unique identifier that changes every time a page at a given URL changes. It acts as a fingerprint. A cache can compare ETag values to see if the page has changed and has become stale. For example, a browser will send the ETag value of a cached page in an If-None-Match header. The web server compares the ETag value sent by the browser with the ETag value of the current version of the page. If both values are the same, the web server sends back a 304 Not Modified status and no body."
}
]
},
"link": {
"value": "; rel=preload; as=script; crossorigin,; rel=preload; as=font; crossorigin,; rel=preload; as=font; crossorigin,; rel=preconnect; crossorigin,; rel=preconnect; crossorigin,; rel=preconnect; crossorigin,; rel=preconnect; crossorigin",
"findings": [
{
"severity": "info",
"message": "rel=\"preconnect\" tells the browser to open a connection to the specified server ahead of time, including DNS lookup, TCP handshake, and TLS negotiation. This is useful when you know you will need resources from a host but don't yet know the exact URLs."
}
]
},
"cache-control": {
"value": "no-cache, no-store",
"findings": [
{
"severity": "info",
"message": "no-cache means the response can be stored by any cache, but the stored response must be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped."
},
{
"severity": "warning",
"message": "no-cache will cause a revalidation request to the origin server for every use of the cached response. Consider using public with appropriate max-age to improve caching efficiency."
},
{
"severity": "warning",
"message": "no-store means the response may not be stored in any cache, including the browser's cache. Every request will hit the origin server. If this page can be cached, consider using public with an appropriate max-age."
},
{
"severity": "notice",
"message": "no-cache is redundant when no-store is set, though some sites keep both for compatibility with older caches."
}
]
},
"content-security-policy": {
"value": "frame-ancestors 'self' godaddy.com *.godaddy.com dev-godaddy.com *.dev-godaddy.com test-godaddy.com *.test-godaddy.com",
"findings": [
{
"severity": "info",
"message": "The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load."
},
{
"severity": "info",
"message": "frame-ancestors defines what parents may embed a page using <frame>, <iframe>, <object>, <embed> or <applet>."
},
{
"severity": "notice",
"message": "Consider adding the upgrade-insecure-requests directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues."
},
{
"severity": "notice",
"message": "No default-src directive is set. Without it, directives that are not explicitly defined have no fallback restriction."
},
{
"severity": "notice",
"message": "Consider adding base-uri 'self' or base-uri 'none' to prevent base tag injection, which can redirect relative URLs to an attacker-controlled domain."
}
]
},
"strict-transport-security": {
"value": "max-age=63072000; includesubdomains; preload",
"findings": [
{
"severity": "info",
"message": "The Strict-Transport-Security header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking."
},
{
"severity": "info",
"message": "max-age specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain."
},
{
"severity": "info",
"message": "includesubdomains instructs the browser that all subdomains are HTTPS-only as well."
},
{
"severity": "info",
"message": "preload recommends the domain for inclusion in browsers' preload lists. If accepted, the domain would get hardcoded into browsers as HTTPS-only."
}
]
},
"content-type": {
"value": "text/html;charset=utf-8",
"findings": [
{
"severity": "info",
"message": "The type of the message body, specified as a MIME type."
}
]
},
"content-encoding": {
"value": "br",
"findings": [
{
"severity": "info",
"message": "Specifies how the resource is compressed. Not to be confused with Transfer-Encoding which specifies how the data is transferred."
},
{
"severity": "info",
"message": "br means that the data is compressed with brotli."
}
]
},
"content-length": {
"value": "27585",
"findings": [
{
"severity": "info",
"message": "The size of the message body, in bytes."
}
]
},
"set-cookie": {
"value": "dps_site_id=us-east-1; path=/; secure",
"findings": [
{
"severity": "info",
"message": "A cookie that was sent from the server to the browser."
},
{
"severity": "info",
"message": "path= indicates the path that must exist in the requested URL for the browser to send the cookie."
},
{
"severity": "info",
"message": "secure instructs the browser to only send the cookie back when HTTPS requests are used, making it more resistant to man-in-the-middle attacks."
},
{
"severity": "notice",
"message": "This cookie is missing the httponly flag. Without it, JavaScript can access the cookie, increasing the risk of cross-site scripting (XSS) attacks."
},
{
"severity": "notice",
"message": "This cookie does not set an explicit samesite attribute. Browsers default to lax, but setting it explicitly is recommended for clarity and cross-browser consistency."
}
]
},
"server": {
"value": "dps/2.0.0+sha-4384650",
"findings": [
{
"severity": "info",
"message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
},
{
"severity": "warning",
"message": "The server header exposes a specific version number (2.0.0). This makes it easier for attackers to find known vulnerabilities for that version. Remove or suppress the version number."
}
]
},
"x-version": {
"value": "4384650",
"findings": [
{
"severity": "info",
"message": "Some of the software used to generate or serve this page."
}
]
},
"x-siteid": {
"value": "us-east-1",
"findings": []
},
"date": {
"value": "sun, 25 oct 2026 17:11:29 gmt",
"findings": [
{
"severity": "info",
"message": "The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires."
}
]
},
"connection": {
"value": "keep-alive",
"findings": [
{
"severity": "info",
"message": "Controls whether the TCP connection stays open after this request finishes. keep-alive means the browser can reuse the same connection for additional requests, avoiding the overhead of a new TCP handshake. close means the connection will be shut down after this response."
}
]
},
"keep-alive": {
"value": "timeout=5",
"findings": [
{
"severity": "info",
"message": "Controls how long a TCP connection stays open between requests. Reusing connections avoids the overhead of repeated TCP handshakes. timeout specifies the number of seconds an idle connection can remain open. max specifies how many requests can be sent on a single connection before it is closed."
}
]
}
},
"missing": {
"referrer-policy": {
"message": "Add a Referrer-Policy header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination."
},
"permissions-policy": {
"message": "Add a Permissions-Policy header. Restrict access to device features like the camera, microphone, location, accelerometer and much more."
},
"cross-origin-embedder-policy": {
"message": "Add a Cross-Origin-Embedder-Policy header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with Cross-Origin-Opener-Policy, it enables cross-origin isolation and access to SharedArrayBuffer."
},
"cross-origin-opener-policy": {
"message": "Add a Cross-Origin-Opener-Policy header. It prevents other sites from retaining a window reference to this page when opened via window.open() or navigation, blocking script-based attacks through shared browsing contexts."
},
"cross-origin-resource-policy": {
"message": "Add a Cross-Origin-Resource-Policy header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
},
"x-content-type-options": {
"message": "Add an X-Content-Type-Options: nosniff header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities."
},
"x-permitted-cross-domain-policies": {
"message": "Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
}
}
}