2020-12-18 website test - strato.de

observatory.mozilla.org

F
Score:	10/100
Tests Passed:	5/11

"Test Scores"
Test	Score	Reason
Content Security Policy	-25	Content Security Policy (CSP) header not implemented
Cookies	0	No cookies detected
Cross-origin Resource Sharing	0	Content is not visible via cross-origin resource sharing (CORS) files or headers
HTTP Public Key Pinning	0	HTTP Public Key Pinning (HPKP) header not implemented (optional)
HTTP Strict Transport Security	-20	HTTP Strict Transport Security (HSTS) header not implemented
Redirection	-10	Redirects to HTTPS eventually, but initial redirection is to another HTTP URL
Referrer Policy	0	Referrer-Policy header not implemented (optional)
Subresource Integrity	0	Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin
X-Content-Type-Options	-5	X-Content-Type-Options header not implemented
X-Frame-Options	-20	X-Frame-Options (XFO) header not implemented
X-XSS-Protection	-10	X-XSS-Protection header not implemented

F
HTTP/1.1	200 OK
Server	Apache/2.2.15 (Red Hat)

"Missing Headers"
Name	Text
Strict-Transport-Security	HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. Recommended value "Strict-Transport-Security: max-age=31536000; includeSubDomains".
Content-Security-Policy	Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
X-Frame-Options	X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN".
X-Content-Type-Options	X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
Referrer-Policy	Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-Policy	Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.

C
53/100

C+
Score:	35/100
PCI-DSS:	Non-compliant
HIPAA:	Non-compliant
NIST:	Non-compliant