{
    "url": "https://site942371822.fo.team",
    "score": 3,
    "summary": {
        "missing": 8,
        "warnings": 3,
        "notices": 5
    },
    "caches": [
        "Website",
        "Browser"
    ],
    "headers": {
        "server": {
            "value": "openresty/1.21.4.1",
            "findings": [
                {
                    "severity": "info",
                    "message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
                },
                {
                    "severity": "warning",
                    "message": "The server header exposes a specific version number (1.21.4). This makes it easier for attackers to find known vulnerabilities for that version. Remove or suppress the version number."
                }
            ]
        },
        "date": {
            "value": "mon, 19 oct 2026 08:48:51 gmt",
            "findings": [
                {
                    "severity": "info",
                    "message": "The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against <code>Max-Age</code> or <code>Expires</code>."
                }
            ]
        },
        "content-type": {
            "value": "text/html; charset=utf-8",
            "findings": [
                {
                    "severity": "info",
                    "message": "The type of the message body, specified as a <a href=\"https://en.wikipedia.org/wiki/Media_type\">MIME type</a>."
                }
            ]
        },
        "vary": {
            "value": "accept-encoding, origin",
            "findings": [
                {
                    "severity": "info",
                    "message": "The <code>Vary</code> header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type."
                }
            ]
        },
        "x-frame-options": {
            "value": "allow-from https://editor.fo.ru/",
            "findings": [
                {
                    "severity": "info",
                    "message": "<code>X-Frame-Options</code> prevents this URL from being embedded in an <code>iframe</code>. This protects against clickjacking attacks."
                },
                {
                    "severity": "info",
                    "message": "<code>allow-from</code> means that this page can be displayed in an <code>iframe</code> but <em>only</em> on the listed URLs."
                },
                {
                    "severity": "notice",
                    "message": "<code>allow-from</code> is deprecated. Use the <code>Content-Security-Policy</code> header with the <code>frame-ancestors</code> directive."
                }
            ]
        },
        "access-control-allow-origin": {
            "value": "https://editor.fo.ru/",
            "findings": [
                {
                    "severity": "info",
                    "message": "Part of CORS (Cross-Origin Resource Sharing). Specifies which origins are allowed to read this response via JavaScript. By default, browsers prevent cross-origin scripts from accessing response data. This header is how a server explicitly grants access to specific origins."
                },
                {
                    "severity": "info",
                    "message": "The browser will only allow code from the specified origin to access this resource."
                }
            ]
        },
        "access-control-allow-credentials": {
            "value": "true",
            "findings": [
                {
                    "severity": "info",
                    "message": "Part of CORS (Cross-Origin Resource Sharing). When set to <code>true</code>, allows the browser to include cookies and authorization headers in cross-origin requests and lets frontend JavaScript read the response. Without this header, the browser will hide the response from scripts even if the request was sent with credentials."
                }
            ]
        },
        "content-security-policy": {
            "value": "frame-ancestors 'self' localhost fo.ru editor.fo.ru yep.com fosite.ru localhost:3000 172.16.55.208:3000 localhost:9222 betaeditor.fo.ru metrika.yandex.ru metrika.yandex.by metrica.yandex.com metrica.yandex.com.tr webvisor.com fo.vin editor.fo.vin mc.yandex.ru *.yandex.tld *.yandex.net webvisor.com mc.yandex.ru mc.yandex.az mc.yandex.by mc.yandex.co.il mc.yandex.com mc.yandex.com.am mc.yandex.com.ge mc.yandex.com.tr mc.yandex.ee mc.yandex.fr mc.yandex.kg mc.yandex.kz mc.yandex.lt mc.yandex.lv mc.yandex.md mc.yandex.tj mc.yandex.tm mc.yandex.uz mc.webvisor.com mc.webvisor.org yastatic.net;",
            "findings": [
                {
                    "severity": "info",
                    "message": "The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load."
                },
                {
                    "severity": "info",
                    "message": "<code>frame-ancestors</code> defines what parents may embed a page using <code>&lt;frame&gt;</code>, <code>&lt;iframe&gt;</code>, <code>&lt;object&gt;</code>, <code>&lt;embed&gt;</code> or <code>&lt;applet&gt;</code>."
                },
                {
                    "severity": "notice",
                    "message": "Consider adding the <code>upgrade-insecure-requests</code> directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues."
                },
                {
                    "severity": "notice",
                    "message": "No <code>default-src</code> directive is set. Without it, directives that are not explicitly defined have no fallback restriction."
                },
                {
                    "severity": "notice",
                    "message": "Consider adding <code>base-uri 'self'</code> or <code>base-uri 'none'</code> to prevent base tag injection, which can redirect relative URLs to an attacker-controlled domain."
                }
            ]
        },
        "etag": {
            "value": "w/\"1f6fa9b3dcc52c1b888607f20175e2c3\"",
            "findings": [
                {
                    "severity": "info",
                    "message": "A unique identifier that changes every time a page at a given URL changes. It acts as a <i>fingerprint</i>. A cache can compare <code>ETag</code> values to see if the page has changed and has become stale. For example, a browser will send the <code>ETag</code> value of a cached page in an <code>If-None-Match</code> header. The web server compares the <code>ETag</code> value sent by the browser with the <code>ETag</code> value of the current version of the page. If both values are the same, the web server sends back a <code>304 Not Modified</code> status and no body. This particular <code>ETag</code> value starts with <code>W/</code> which means that it is a <i>weak identifier</i>; while unlikely, multiple pages might have the same identifier. Weak identifiers are used because <i>strong identifiers</i> can be difficult and costly to generate."
                }
            ]
        },
        "cache-control": {
            "value": "max-age=0, private, must-revalidate",
            "findings": [
                {
                    "severity": "info",
                    "message": "<code>private</code> means the response can <em>only</em> be stored by the browser's cache, but <em>not</em> by CDNs, proxies, or any other shared caches."
                },
                {
                    "severity": "info",
                    "message": "<code>max-age=0</code> with <code>must-revalidate</code> means caching is disabled and all requests must be validated with the origin server."
                }
            ]
        },
        "set-cookie": {
            "value": "xsrf-token=o%2fh6mksrth2g3cap6htker25bjowzrzblywvdbfckfuy1lozi1gn9zbtd71plvds%2f4zgab3maian7mjiyv97lg%3d%3d; path=/; secure; samesite=none, foru_session=vepmuw5cc0hdyxpnbwdsm056ckl2dezroxvwd3bpegfhbtbqqjb3z2d0rklouvjnzzrwsjzdakpkm0vrueh4nmzzewn1zlnfv1b1skrssdj3z2xcm0rymkzccddtvti1njr2tlpvbmpjrc94v2c4zzvgr05ou2y3txhicm92q0dqsunjvhbpas9zdi96nkfjamtgbhdrpt0tlupvbvfutmvxmfvqwepgqujpu2ddsfe9pq%3d%3d--ddb9110bd9e0aa24a843d092338c41d8728f39aa; domain=.site942371822.fo.team; path=/; expires=mon, 02 nov 2026 08:48:49 gmt; secure; samesite=none",
            "findings": [
                {
                    "severity": "info",
                    "message": "A cookie that was sent from the server to the browser."
                },
                {
                    "severity": "info",
                    "message": "<code>expires=</code> sets the maximum lifetime of the cookie using a specific date."
                },
                {
                    "severity": "info",
                    "message": "<code>domain=</code> sets the domain to which the cookie will be sent."
                },
                {
                    "severity": "info",
                    "message": "<code>path=</code> indicates the path that must exist in the requested URL for the browser to send the cookie."
                },
                {
                    "severity": "warning",
                    "message": "<code>samesite=none</code> instructs the browser to send the cookie to all cross-site requests, such as on requests to load images or frames from other sites. This enables third-party sites to log cookie data. This could lead to data leaks and cross-site request forgery attacks. To improve security, set to <code>samesite=strict</code> or <code>samesite=lax</code>."
                },
                {
                    "severity": "info",
                    "message": "<code>secure</code> instructs the browser to only send the cookie back when HTTPS requests are used, making it more resistant to man-in-the-middle attacks."
                },
                {
                    "severity": "notice",
                    "message": "This cookie is missing the <code>httponly</code> flag. Without it, JavaScript can access the cookie, increasing the risk of cross-site scripting (XSS) attacks."
                }
            ]
        },
        "x-request-id": {
            "value": "8e930b02-a713-41e1-9d60-5f9c7aea9f9b",
            "findings": [
                {
                    "severity": "info",
                    "message": "A unique identifier for the HTTP request. This can be useful for tracking a request through complex systems or for debugging purposes."
                }
            ]
        },
        "x-runtime": {
            "value": "0.036339",
            "findings": [
                {
                    "severity": "info",
                    "message": "Indicates the time taken to generate the response on the server, typically in seconds. This can be useful for performance monitoring and debugging."
                }
            ]
        },
        "content-encoding": {
            "value": "gzip",
            "findings": [
                {
                    "severity": "info",
                    "message": "Specifies how the resource is <em>compressed</em>. Not to be confused with <code>Transfer-Encoding</code> which specifies how the data is transferred."
                },
                {
                    "severity": "info",
                    "message": "<code>gzip</code> means that the data is compressed with <code>gzip</code>."
                },
                {
                    "severity": "warning",
                    "message": "Add a <code>Content-Length</code> header. The Content-Length header is required, unless the message is transported using chunked encoding. Without a <code>Content-Length</code> header some servers will respond with 400 (bad request) or terminate connections early."
                }
            ]
        }
    },
    "missing": {
        "strict-transport-security": {
            "message": "Add a <code>Strict-Transport-Security</code> header. The <code>Strict-Transport-Security</code> header or <i>HSTS</i> header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication."
        },
        "referrer-policy": {
            "message": "Add a <code>Referrer-Policy</code> header. When a visitor navigates from one page to another, browsers often pass along <em>referrer information</em>. The <code>Referrer-Policy</code> header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the <i>path</i> or <i>query string</i> and passed onto an external destination."
        },
        "permissions-policy": {
            "message": "Add a <code>Permissions-Policy</code> header. Restrict access to device features like the camera, microphone, location, accelerometer and much more."
        },
        "cross-origin-embedder-policy": {
            "message": "Add a <code>Cross-Origin-Embedder-Policy</code> header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with <code>Cross-Origin-Opener-Policy</code>, it enables cross-origin isolation and access to <code>SharedArrayBuffer</code>."
        },
        "cross-origin-opener-policy": {
            "message": "Add a <code>Cross-Origin-Opener-Policy</code> header. It prevents other sites from retaining a <code>window</code> reference to this page when opened via <code>window.open()</code> or navigation, blocking script-based attacks through shared browsing contexts."
        },
        "cross-origin-resource-policy": {
            "message": "Add a <code>Cross-Origin-Resource-Policy</code> header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
        },
        "x-content-type-options": {
            "message": "Add an <code>X-Content-Type-Options: nosniff</code> header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities."
        },
        "x-permitted-cross-domain-policies": {
            "message": "Add a <code>X-Permitted-Cross-Domain-Policies</code> header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
        }
    }
}