example.com

Who can exploit this: Someone on the same network as your user (public Wi-Fi)

• example.com: plain HTTP is served without redirecting to HTTPS (/ /login)

What it means

Visitors who type your address without https:// can be served an unencrypted page, which an attacker on the network can tamper with.

How to fix

1. Turn on 'Force HTTPS' / 'Always use HTTPS' in your host or CDN, or add a 301 redirect from http:// to https://.
2. Add HSTS (see the related finding).
3. Run the recheck.

Fix prompt for your AI assistant

Who can exploit this: An attacker who manages to inject a script

• Site: no Content-Security-Policy (no defence in depth against injected scripts)

What it means

A Content-Security-Policy tells the browser which scripts may run. Without one, any script an attacker manages to inject (through a comment, a profile field or a compromised library) runs with full access to your users' sessions.

How to fix

1. Start with a policy like: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; then add the domains your app really loads from (Supabase, analytics, fonts).
2. Try it first as Content-Security-Policy-Report-Only, fix what breaks, then switch to enforcing.
3. Run the recheck.

Fix prompt for your AI assistant

Who can exploit this: Someone on the same network as your user (public Wi-Fi)

• Site: no HSTS (Strict-Transport-Security)

What it means

HSTS tells browsers to always use HTTPS for your site. Without it, a user's first visit over public Wi-Fi can be downgraded to unencrypted HTTP.

How to fix

1. Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response.
2. Run the recheck.

Fix prompt for your AI assistant

Who can exploit this: A malicious site your logged-in users visit

• Site: can be framed by any site (no X-Frame-Options or frame-ancestors) -- clickjacking

What it means

A malicious site can load your app invisibly in a frame and trick logged-in users into clicking buttons they can't see, such as 'delete' or 'transfer'.

How to fix

1. Send Content-Security-Policy: frame-ancestors 'self' (and X-Frame-Options: DENY for older browsers).
2. Run the recheck.

Fix prompt for your AI assistant

Who can exploit this: Someone on the same network as your user (public Wi-Fi)

• example.com: obsolete protocol accepted: TLS 1.0, TLS 1.1

What it means

TLS 1.0 and 1.1 have known weaknesses and are retired by all major browsers.

How to fix

1. Allow only TLS 1.2 and 1.3 in your server or CDN settings.
2. Run the recheck.

Fix prompt for your AI assistant

Who can exploit this: Anyone on the internet

• Hosting control panel login reachable from the internet: cPanel (:2083, 200), WHM (:2087, 200), Webmail (:2096, 200) -- use a strong password and 2FA, or limit it to your IPs

What it means

The login page of your hosting control panel (cPanel, Plesk…) is reachable by anyone, so its password is the only thing protecting your whole server.

How to fix

1. Use a long unique password and enable two-factor authentication.
2. If your host allows it, restrict the panel to your IP addresses.

Who can exploit this: Attackers mapping your site for weak spots

• Site: no Referrer-Policy

What it means

Without a Referrer-Policy, full page URLs (which can contain IDs or tokens) may be sent to other sites your pages link to.

How to fix

1. Send Referrer-Policy: strict-origin-when-cross-origin.
2. Run the recheck.

Fix prompt for your AI assistant

Who can exploit this: An attacker who manages to inject a script

• Site: no X-Content-Type-Options: nosniff

What it means

Without nosniff, browsers may guess file types, which can turn an uploaded file into running script.

How to fix

1. Send X-Content-Type-Options: nosniff on every response.
2. Run the recheck.

Fix prompt for your AI assistant

Who can exploit this: Nobody directly; good practice

• A server-side filter (406, e.g. ModSecurity) blocked 2 probe(s) -- those files were not tested

What it means

A web application firewall answered 406 to some probes, so those paths were not tested. That is fine; it just limits what this scan could see.

Who can exploit this: Nobody directly; good practice

• Page has 3 inline script(s) without a nonce: a strict CSP needs nonces or hashes for them

What it means

Not a vulnerability by itself, but a strict Content-Security-Policy will need nonces or hashes for these scripts.

Who can exploit this: Nobody directly; good practice

• Site: no Permissions-Policy

What it means

A Permissions-Policy switches off browser features (camera, microphone, location) your site doesn't use, limiting what an injected script could do.

How to fix

1. Send e.g. Permissions-Policy: camera=(), microphone=(), geolocation=() for features you don't use.

Fix prompt for your AI assistant

Who can exploit this: Nobody directly; good practice

• No /.well-known/security.txt (how researchers can report issues)

What it means

/.well-known/security.txt tells people who find a vulnerability how to report it to you, instead of posting it publicly.

How to fix

1. Publish /.well-known/security.txt with a Contact: line (email or URL) and an Expires: date.

Fix prompt for your AI assistant

Who can exploit this: Nobody directly; good practice

• The app talks to other hosts on your domain that this scan did not test: api.example.com -- add and verify each one to include it

What it means

Your app talks to other hosts on your domain. They were not tested because only the verified host is scanned. Add and verify them to cover your whole app.

Who can exploit this: Nobody directly; good practice

• Served through Cloudflare

Who can exploit this: An attacker who manages to inject a script

• The app appears to keep its session token in localStorage (readable by any script on the page; CSP matters more)

What it means

Anything in localStorage can be read by any script on the page. If a script is ever injected, it can steal sessions. This is common (Supabase does it by default) and makes a strong CSP more important.

How to fix

1. Keep a strict Content-Security-Policy.
2. If you control the backend, consider HttpOnly cookies for sessions.

Fix prompt for your AI assistant

Who can exploit this: Nobody directly; good practice

• Known-vulnerability lookup (OSV.dev) did not answer for react-dom 19.2.5; library advisories were not rechecked this time
• The DNS lookup for example.com did not answer, so email spoofing, CAA and certificate-log checks were not rechecked this time

What it means

The site (or an outside lookup) blocked, rate-limited or did not answer these checks, so they were neither confirmed nor cleared. A "passed" result is never shown for them, and earlier problems are not counted as fixed. Allow the scanner through your firewall or bot protection, or run the scan again later.