response-example.json

{
  "score": "F",
  "securityReportSummary": {
    "site": "http://www.example.com/\n                                                                                                                         - (Scan again over https)",
    "ipAddress": "2606:2800:220:1:248:1893:25c8:1946",
    "reportTime": "27 Jun 2017 21:15:48 UTC",
    "reportShortUrl": "Hidden scans do not get a short URL.",
    "headers": "Content-Security-Policy X-Frame-Options X-XSS-Protection X-Content-Type-Options Referrer-Policy"
  },
  "rawHeaders": {
    "HTTP/1.1": "200 OK",
    "Cache-Control": "max-age=604800",
    "Content-Type": "text/html",
    "Date": "Tue, 27 Jun 2017 21:15:47 GMT",
    "Etag": "\"359670651+gzip+ident\"",
    "Expires": "Tue, 04 Jul 2017 21:15:47 GMT",
    "Last-Modified": "Fri, 09 Aug 2013 23:54:35 GMT",
    "Server": "ECS (sjc/4E52)",
    "Vary": "Accept-Encoding",
    "X-Cache": "HIT",
    "Content-Length": "1270"
  },
  "missingHeaders": {
    "Content-Security-Policy": "Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.",
    "X-Frame-Options": "X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value \"x-frame-options: SAMEORIGIN\".",
    "X-XSS-Protection": "X-XSS-Protection sets the configuration for the cross-site scripting filter built into most browsers. Recommended value \"X-XSS-Protection: 1; mode=block\".",
    "X-Content-Type-Options": "X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is \"X-Content-Type-Options: nosniff\".",
    "Referrer-Policy": "Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites."
  },
  "otherServices": {
    "Secarma": "For cybersecurity testing, consultancy & training visit our sponsor Secarma."
  },
  "upcomingHeaders": {
    "Expect-CT": "Expect-CT allows a site to determine if they are ready for the upcoming Chrome requirements and/or enforce their CT policy."
  },
  "additionalInformation": {
    "Server": "Server value has been changed. Typically you will see values like \"Microsoft-IIS/8.0\" or \"nginx 1.7.2\"."
  }
}