{
"url": "https://siyaa1.weebly.com",
"score": 4,
"summary": {
"missing": 11,
"warnings": 1,
"notices": 2
},
"caches": [
"Website",
"Cloudflare",
"Browser"
],
"headers": {
"date": {
"value": "fri, 16 oct 2026 19:52:40 gmt",
"findings": [
{
"severity": "info",
"message": "The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires."
}
]
},
"content-type": {
"value": "text/html; charset=utf-8",
"findings": [
{
"severity": "info",
"message": "The type of the message body, specified as a MIME type."
}
]
},
"cf-ray": {
"value": "a4b99af39d6a492d-iad",
"findings": [
{
"severity": "info",
"message": "The cf-ray header provides a unique identifier for each request through Cloudflare. It's useful for troubleshooting and tracking requests in Cloudflare logs."
}
]
},
"cf-cache-status": {
"value": "bypass",
"findings": [
{
"severity": "warning",
"message": "The origin server instructed Cloudflare to bypass cache via a Cache-Control header set to no-cache, private, or max-age=0. bypass is returned when enabling the Origin Cache-Control setting."
}
]
},
"server": {
"value": "cloudflare",
"findings": [
{
"severity": "info",
"message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
},
{
"severity": "notice",
"message": "Consider removing or minimizing the Server header. Even without a version number, it reveals the server software, which aids reconnaissance."
}
]
},
"set-cookie": {
"value": "__cf_bm=w1vejvnydd2latirj3nmgzdpivn23igxcargsg86_no-1792180360.2586489-1.0.1.1-kem5jjtsi_fh64rfqsid9rrp37wxbkd0jbe7kzargeddwq7oxudve.kalwvgyhophhdp8ddnffe_hvzmcidtylmdxf1wi_rofv1lewil.0oi32rle6z1dwor_xwqj0ql; httponly; secure; path=/; domain=weebly.com; expires=fri, 16 oct 2026 20:22:40 gmt",
"findings": [
{
"severity": "info",
"message": "A cookie that was sent from the server to the browser."
},
{
"severity": "info",
"message": "expires= sets the maximum lifetime of the cookie using a specific date."
},
{
"severity": "info",
"message": "domain= sets the domain to which the cookie will be sent."
},
{
"severity": "info",
"message": "path= indicates the path that must exist in the requested URL for the browser to send the cookie."
},
{
"severity": "info",
"message": "secure instructs the browser to only send the cookie back when HTTPS requests are used, making it more resistant to man-in-the-middle attacks."
},
{
"severity": "info",
"message": "httponly forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie."
},
{
"severity": "notice",
"message": "This cookie does not set an explicit samesite attribute. Browsers default to lax, but setting it explicitly is recommended for clarity and cross-browser consistency."
},
{
"severity": "info",
"message": "cf_bm is a cookie set by Cloudflare to support bot management. This is a technical cookie; it's exempt from GDPR and doesn't need user consent."
}
]
}
},
"missing": {
"strict-transport-security": {
"message": "Add a Strict-Transport-Security header. The Strict-Transport-Security header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication."
},
"content-security-policy": {
"message": "Add a Content-Security-Policy header. The Content-Security-Policy header helps browsers prevent cross site scripting (XSS) and data injection attacks."
},
"referrer-policy": {
"message": "Add a Referrer-Policy header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination."
},
"permissions-policy": {
"message": "Add a Permissions-Policy header. Restrict access to device features like the camera, microphone, location, accelerometer and much more."
},
"cross-origin-embedder-policy": {
"message": "Add a Cross-Origin-Embedder-Policy header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with Cross-Origin-Opener-Policy, it enables cross-origin isolation and access to SharedArrayBuffer."
},
"cross-origin-opener-policy": {
"message": "Add a Cross-Origin-Opener-Policy header. It prevents other sites from retaining a window reference to this page when opened via window.open() or navigation, blocking script-based attacks through shared browsing contexts."
},
"cross-origin-resource-policy": {
"message": "Add a Cross-Origin-Resource-Policy header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
},
"x-frame-options": {
"message": "Add a X-Frame-Options header. The X-Frame-Options header prevents this URL from being embedded in an iframe. This protects against clickjacking attacks. Alternatively, set a Content-Security-Policy header with a frame-ancestors directive."
},
"x-content-type-options": {
"message": "Add an X-Content-Type-Options: nosniff header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities."
},
"x-permitted-cross-domain-policies": {
"message": "Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
},
"content-encoding": {
"message": "No Content-Encoding header found. Enable compression such as gzip or br (Brotli) to reduce transfer sizes. Brotli typically achieves 15–20% better compression than gzip and is supported by all modern browsers."
}
}
}