{
"url": "https://mb66.parts",
"score": 2,
"summary": {
"missing": 5,
"warnings": 4,
"notices": 9
},
"caches": [
"Website",
"Cloudflare",
"Browser"
],
"headers": {
"date": {
"value": "sun, 26 jul 2026 20:29:51 gmt",
"findings": [
{
"severity": "info",
"message": "The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires."
}
]
},
"content-type": {
"value": "text/html; charset=utf-8",
"findings": [
{
"severity": "info",
"message": "The type of the message body, specified as a MIME type."
}
]
},
"server": {
"value": "cloudflare",
"findings": [
{
"severity": "info",
"message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
},
{
"severity": "notice",
"message": "Consider removing or minimizing the Server header. Even without a version number, it reveals the server software, which aids reconnaissance."
}
]
},
"nel": {
"value": "{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}",
"findings": [
{
"severity": "info",
"message": "The NEL (Network Error Logging) header tells browsers to report network-level failures (DNS errors, TCP timeouts, TLS problems) back to the server. This means you can detect when real users fail to reach your site, even though the failure happens before your server sees a request."
},
{
"severity": "info",
"message": "report_to defines the reporting group that reports for this NEL policy will be sent to. The reporting group details are specified in the Report-To header."
},
{
"severity": "info",
"message": "max_age defines the number of seconds the browser should remember these settings. Prevents the browser from having to parse the JSON on each request."
},
{
"severity": "info",
"message": "success_fraction defines the sampling rate that should be applied to reports about successful network requests. Its value must be a number between 0.0 and 1.0: 0 means no successful requests should be reported, and 1 means that every successful request should be reported."
}
]
},
"vary": {
"value": "accept-encoding",
"findings": [
{
"severity": "info",
"message": "The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type."
}
]
},
"set-cookie": {
"value": "phpsessid=vspmua1ao8h0vh9d6v3uaf5iu4; path=/; httponly",
"findings": [
{
"severity": "info",
"message": "A cookie that was sent from the server to the browser."
},
{
"severity": "info",
"message": "path= indicates the path that must exist in the requested URL for the browser to send the cookie."
},
{
"severity": "info",
"message": "httponly forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie."
},
{
"severity": "warning",
"message": "This cookie is missing the secure flag. Without it, the cookie can be sent over unencrypted HTTP connections, making it vulnerable to interception."
},
{
"severity": "notice",
"message": "This cookie does not set an explicit samesite attribute. Browsers default to lax, but setting it explicitly is recommended for clarity and cross-browser consistency."
}
]
},
"expires": {
"value": "thu, 19 nov 1981 08:52:00 gmt",
"findings": [
{
"severity": "info",
"message": "This Expires date is in the past: the page is considered stale and will be removed from all caches."
},
{
"severity": "notice",
"message": "The Cache-Control header, introduced in HTTP/1.1, supersedes the Expires header. Use a Cache-Control header with a max-age directive instead of Expires. Cache-Control is more powerful, but also more efficient in that it avoids roundtrips to the origin server."
},
{
"severity": "info",
"message": "PS: November 19th is my birthday! 🎂"
}
]
},
"cache-control": {
"value": "no-store, no-cache, must-revalidate",
"findings": [
{
"severity": "info",
"message": "no-cache means the response can be stored by any cache, but the stored response must be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped."
},
{
"severity": "warning",
"message": "no-cache will cause a revalidation request to the origin server for every use of the cached response. Consider using public with appropriate max-age to improve caching efficiency."
},
{
"severity": "warning",
"message": "no-store means the response may not be stored in any cache, including the browser's cache. Every request will hit the origin server. If this page can be cached, consider using public with an appropriate max-age."
},
{
"severity": "info",
"message": "must-revalidate indicates that once a page becomes stale, both shared caches and browser caches must not use their stale copy without validating it with the origin server first."
},
{
"severity": "notice",
"message": "must-revalidate has no effect with no-store since nothing is cached. Remove must-revalidate."
},
{
"severity": "notice",
"message": "must-revalidate is redundant with no-cache since no-cache already requires revalidation. Remove must-revalidate."
},
{
"severity": "notice",
"message": "no-cache is redundant when no-store is set, though some sites keep both for compatibility with older caches."
}
]
},
"pragma": {
"value": "no-cache",
"findings": [
{
"severity": "notice",
"message": "Pragma: no-cache forces revalidation with the origin server on every request. Pragma is a legacy HTTP/1.0 directive, superseded by Cache-Control. Remove Pragma to save bandwidth and processing power."
}
]
},
"strict-transport-security": {
"value": "max-age=31536000; includesubdomains; preload",
"findings": [
{
"severity": "info",
"message": "The Strict-Transport-Security header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking."
},
{
"severity": "info",
"message": "max-age specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain."
},
{
"severity": "info",
"message": "includesubdomains instructs the browser that all subdomains are HTTPS-only as well."
},
{
"severity": "info",
"message": "preload recommends the domain for inclusion in browsers' preload lists. If accepted, the domain would get hardcoded into browsers as HTTPS-only."
}
]
},
"x-frame-options": {
"value": "deny",
"findings": [
{
"severity": "info",
"message": "X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks."
},
{
"severity": "info",
"message": "deny means that this page can never be displayed in an iframe. It's the most secure option."
}
]
},
"x-content-type-options": {
"value": "nosniff",
"findings": [
{
"severity": "info",
"message": "The X-Content-Type-Options header prevents browsers from guessing a response's content type. Without it, browsers may interpret files differently than intended, which can lead to security vulnerabilities."
},
{
"severity": "info",
"message": "The value nosniff is correctly set."
}
]
},
"x-xss-protection": {
"value": "1; mode=block",
"findings": [
{
"severity": "info",
"message": "A legacy header that enables the browser's built-in cross-site scripting (XSS) filter. Modern browsers ignore it in favor of Content-Security-Policy."
},
{
"severity": "info",
"message": "1 enables XSS filtering."
},
{
"severity": "info",
"message": "mode=block blocks the response entirely if an attack is detected, instead of sanitizing the page."
},
{
"severity": "notice",
"message": "Add a Content-Security-Policy header for more comprehensive protection."
}
]
},
"referrer-policy": {
"value": "strict-origin",
"findings": [
{
"severity": "info",
"message": "When a visitor navigates from one page to another page, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string."
},
{
"severity": "info",
"message": "strict-origin means that the protocol, host, and port are shared, but only when the protocol security level remains the same (HTTPS → HTTPS). The path and query string are not shared. When the protocol becomes less secure (HTTPS → HTTP), nothing is shared."
}
]
},
"permissions-policy": {
"value": "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()",
"findings": [
{
"severity": "info",
"message": "Controls which browser features and APIs (camera, microphone, geolocation, payment, USB, etc.) this page and its embedded iframes are allowed to use. Each feature is set to an allowlist of origins; an empty list () disables the feature entirely. This is a defense-in-depth measure: even if an attacker injects script via XSS, they cannot access the restricted APIs."
}
]
},
"report-to": {
"value": "{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tp0cd50p8zdg%2fwwwa4b6akf2f9cgqgs2x%2f5qjec2vtvd6kdawfhwnduukfkgee25anqronvvotuxjxo0iutzrbfjsommspglqfs%2bfpmpj8f7posgfevbrxq9btfwvrxts5rqxq%3d%3d\"}]}",
"findings": [
{
"severity": "info",
"message": "The Report-To header defines where browsers should send error reports. It sets up named reporting endpoints that other headers (like NEL and Content-Security-Policy) reference when they need to send violation or failure data."
},
{
"severity": "info",
"message": "group defines the reporting group. Groups allow reports to be grouped logically; e.g. there could be a group for network errors and a second group for browser feature deprecation reports."
},
{
"severity": "info",
"message": "max_age defines the number of seconds the browser should remember these settings. Prevents the browser from having to parse the JSON on each request."
},
{
"severity": "info",
"message": "endpoints defines one or more URLs where the reports need to be sent to. Multiple URLs can be specified for failover and load-balancing. Endpoints can be assigned a weight to distribute load, with each endpoint receiving a specified fraction of the reporting traffic. Endpoints can also be assigned a priority to set up fallback collectors."
}
]
},
"cf-cache-status": {
"value": "dynamic",
"findings": [
{
"severity": "notice",
"message": "The dynamic status indicates that Cloudflare did not cache this resource. This is normal and expected for HTML pages — by default, Cloudflare only caches static assets like images, CSS, and JavaScript. To cache HTML content as well, change the 'Cache Level' setting from dynamic to cache everything in Cloudflare."
}
]
},
"speculation-rules": {
"value": "\"/cdn-cgi/speculation\"",
"findings": [
{
"severity": "info",
"message": "Points to a JSON resource that defines rules for speculative loading, telling the browser to prefetch or prerender pages the user is likely to visit next. This can make navigations feel instant."
}
]
},
"content-encoding": {
"value": "br",
"findings": [
{
"severity": "info",
"message": "Specifies how the resource is compressed. Not to be confused with Transfer-Encoding which specifies how the data is transferred."
},
{
"severity": "info",
"message": "br means that the data is compressed with brotli."
},
{
"severity": "warning",
"message": "Add a Content-Length header. The Content-Length header is required, unless the message is transported using chunked encoding. Without a Content-Length header some servers will respond with 400 (bad request) or terminate connections early."
}
]
},
"cf-ray": {
"value": "a21628ad59f5f83a-iad",
"findings": [
{
"severity": "info",
"message": "The cf-ray header provides a unique identifier for each request through Cloudflare. It's useful for troubleshooting and tracking requests in Cloudflare logs."
}
]
},
"alt-svc": {
"value": "h3=\":443\"; ma=86400",
"findings": [
{
"severity": "info",
"message": "The alt-svc header tells the browser that the same content is available over a different protocol. This allows the browser to upgrade to a faster protocol (e.g. HTTP/3 over QUIC) on subsequent requests without a separate negotiation step."
},
{
"severity": "info",
"message": "h3 indicates that HTTP/3 is supported. HTTP/3 uses the QUIC protocol (UDP-based) instead of TCP, which eliminates the TCP handshake delay and performs better on lossy networks. Variants like h3-29 refer to specific drafts of the HTTP/3 protocol."
},
{
"severity": "info",
"message": "ma=86400 specifies that the alternative service information is fresh for 86400 seconds."
}
]
}
},
"missing": {
"content-security-policy": {
"message": "Add a Content-Security-Policy header. The Content-Security-Policy header helps browsers prevent cross site scripting (XSS) and data injection attacks."
},
"cross-origin-embedder-policy": {
"message": "Add a Cross-Origin-Embedder-Policy header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with Cross-Origin-Opener-Policy, it enables cross-origin isolation and access to SharedArrayBuffer."
},
"cross-origin-opener-policy": {
"message": "Add a Cross-Origin-Opener-Policy header. It prevents other sites from retaining a window reference to this page when opened via window.open() or navigation, blocking script-based attacks through shared browsing contexts."
},
"cross-origin-resource-policy": {
"message": "Add a Cross-Origin-Resource-Policy header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
},
"x-permitted-cross-domain-policies": {
"message": "Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
}
}
}