{
    "url": "https://liff.line.me/2006764136-15GRqjpg",
    "score": 2,
    "summary": {
        "missing": 8,
        "warnings": 3,
        "notices": 7
    },
    "caches": [
        "Website",
        "Nginx",
        "Browser"
    ],
    "headers": {
        "server": {
            "value": "nginx",
            "findings": [
                {
                    "severity": "info",
                    "message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
                },
                {
                    "severity": "notice",
                    "message": "Consider removing or minimizing the <code>Server</code> header. Even without a version number, it reveals the server software, which aids reconnaissance."
                }
            ]
        },
        "date": {
            "value": "thu, 25 jun 2026 03:52:20 gmt",
            "findings": [
                {
                    "severity": "info",
                    "message": "The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against <code>Max-Age</code> or <code>Expires</code>."
                }
            ]
        },
        "content-type": {
            "value": "text/html;charset=utf-8",
            "findings": [
                {
                    "severity": "info",
                    "message": "The type of the message body, specified as a <a href=\"https://en.wikipedia.org/wiki/Media_type\">MIME type</a>."
                }
            ]
        },
        "content-length": {
            "value": "1735",
            "findings": [
                {
                    "severity": "info",
                    "message": "The size of the message body, in bytes."
                }
            ]
        },
        "vary": {
            "value": "origin, access-control-request-method, access-control-request-headers",
            "findings": [
                {
                    "severity": "info",
                    "message": "The <code>Vary</code> header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type."
                }
            ]
        },
        "x-content-type-options": {
            "value": "nosniff",
            "findings": [
                {
                    "severity": "info",
                    "message": "The <code>X-Content-Type-Options</code> header prevents browsers from guessing a response's content type. Without it, browsers may interpret files differently than intended, which can lead to security vulnerabilities."
                },
                {
                    "severity": "info",
                    "message": "The value <code>nosniff</code> is correctly set."
                }
            ]
        },
        "x-xss-protection": {
            "value": "0",
            "findings": [
                {
                    "severity": "info",
                    "message": "A legacy header that enables the browser's built-in cross-site scripting (XSS) filter. Modern browsers ignore it in favor of <code>Content-Security-Policy</code>."
                },
                {
                    "severity": "warning",
                    "message": "<code>0</code> disables XSS filtering. Remove this header or set the value to <code>1</code>."
                },
                {
                    "severity": "notice",
                    "message": "Add a <code>Content-Security-Policy</code> header for more comprehensive protection."
                }
            ]
        },
        "cache-control": {
            "value": "no-cache, no-store, max-age=0, must-revalidate",
            "findings": [
                {
                    "severity": "info",
                    "message": "<code>no-cache</code> means the response can be stored by <em>any</em> cache, but the stored response <strong>must</strong> be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped."
                },
                {
                    "severity": "warning",
                    "message": "<code>no-cache</code> will cause a revalidation request to the origin server for <em>every</em> use of the cached response. Consider using <code>public</code> with appropriate <code>max-age</code> to improve caching efficiency."
                },
                {
                    "severity": "warning",
                    "message": "<code>no-store</code> means the response may <em>not</em> be stored in <em>any</em> cache, including the browser's cache. Every request will hit the origin server. If this page can be cached, consider using <code>public</code> with an appropriate <code>max-age</code>."
                },
                {
                    "severity": "info",
                    "message": "<code>max-age=0</code> with <code>must-revalidate</code> means caching is disabled and all requests must be validated with the origin server."
                },
                {
                    "severity": "notice",
                    "message": "<code>must-revalidate</code> has no effect with <code>no-store</code> since nothing is cached. Remove <code>must-revalidate</code>."
                },
                {
                    "severity": "notice",
                    "message": "<code>must-revalidate</code> is redundant with <code>no-cache</code> since <code>no-cache</code> already requires revalidation. Remove <code>must-revalidate</code>."
                },
                {
                    "severity": "notice",
                    "message": "<code>no-cache</code> is redundant when <code>no-store</code> is set, though some sites keep both for compatibility with older caches."
                }
            ]
        },
        "pragma": {
            "value": "no-cache",
            "findings": [
                {
                    "severity": "notice",
                    "message": "<code>Pragma: no-cache</code> forces revalidation with the origin server on every request. <code>Pragma</code> is a legacy HTTP/1.0 directive, superseded by <code>Cache-Control</code>. Remove <code>Pragma</code> to save bandwidth and processing power."
                }
            ]
        },
        "expires": {
            "value": "0",
            "findings": [
                {
                    "severity": "info",
                    "message": "This <code>Expires</code> date is in the past: the page is considered stale and will be removed from <em>all</em> caches."
                },
                {
                    "severity": "notice",
                    "message": "Because there is a <code>Cache-Control</code> header with a <code>max-age</code> and/or <code>s-maxage</code> directive, the <code>Expires</code> header will be ignored. Consider removing <code>Expires</code> to save bandwidth and processing power."
                }
            ]
        },
        "strict-transport-security": {
            "value": "max-age=31536000 ; includesubdomains",
            "findings": [
                {
                    "severity": "info",
                    "message": "The <code>Strict-Transport-Security</code> header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking."
                },
                {
                    "severity": "info",
                    "message": "<code>max-age</code> specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain."
                },
                {
                    "severity": "info",
                    "message": "<code>includesubdomains</code> instructs the browser that all subdomains are HTTPS-only as well."
                }
            ]
        },
        "x-frame-options": {
            "value": "deny",
            "findings": [
                {
                    "severity": "info",
                    "message": "<code>X-Frame-Options</code> prevents this URL from being embedded in an <code>iframe</code>. This protects against clickjacking attacks."
                },
                {
                    "severity": "info",
                    "message": "<code>deny</code> means that this page can <em>never</em> be displayed in an <code>iframe</code>. It's the most secure option."
                }
            ]
        },
        "content-language": {
            "value": "en-us",
            "findings": [
                {
                    "severity": "info",
                    "message": "Specifies the page's intended audience. For example, <code>en-US</code> means that the document is intended for English language speakers in the United States. The language tags are defined in <a href=\"https://datatracker.ietf.org/doc/html/rfc5646\">RFC 5646</a>."
                }
            ]
        }
    },
    "missing": {
        "content-security-policy": {
            "message": "Add a <code>Content-Security-Policy</code> header. The <code>Content-Security-Policy</code> header helps browsers prevent cross site scripting (XSS) and data injection attacks."
        },
        "referrer-policy": {
            "message": "Add a <code>Referrer-Policy</code> header. When a visitor navigates from one page to another, browsers often pass along <em>referrer information</em>. The <code>Referrer-Policy</code> header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the <i>path</i> or <i>query string</i> and passed onto an external destination."
        },
        "permissions-policy": {
            "message": "Add a <code>Permissions-Policy</code> header. Restrict access to device features like the camera, microphone, location, accelerometer and much more."
        },
        "cross-origin-embedder-policy": {
            "message": "Add a <code>Cross-Origin-Embedder-Policy</code> header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with <code>Cross-Origin-Opener-Policy</code>, it enables cross-origin isolation and access to <code>SharedArrayBuffer</code>."
        },
        "cross-origin-opener-policy": {
            "message": "Add a <code>Cross-Origin-Opener-Policy</code> header. It prevents other sites from retaining a <code>window</code> reference to this page when opened via <code>window.open()</code> or navigation, blocking script-based attacks through shared browsing contexts."
        },
        "cross-origin-resource-policy": {
            "message": "Add a <code>Cross-Origin-Resource-Policy</code> header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
        },
        "x-permitted-cross-domain-policies": {
            "message": "Add a <code>X-Permitted-Cross-Domain-Policies</code> header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
        },
        "content-encoding": {
            "message": "No <code>Content-Encoding</code> header found. Enable compression such as <code>gzip</code> or <code>br</code> (Brotli) to reduce transfer sizes. Brotli typically achieves 15–20% better compression than gzip and is supported by all modern browsers."
        }
    }
}