forked from rogerbf/security-headers
-
Notifications
You must be signed in to change notification settings - Fork 0
/
response-example.json
39 lines (39 loc) · 2.47 KB
/
response-example.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
"score": "F",
"securityReportSummary": {
"site": "http://www.example.com/\n - (Scan again over https)",
"ipAddress": "2606:2800:220:1:248:1893:25c8:1946",
"reportTime": "27 Jun 2017 21:15:48 UTC",
"reportShortUrl": "Hidden scans do not get a short URL.",
"headers": "Content-Security-Policy X-Frame-Options X-XSS-Protection X-Content-Type-Options Referrer-Policy"
},
"rawHeaders": {
"HTTP/1.1": "200 OK",
"Cache-Control": "max-age=604800",
"Content-Type": "text/html",
"Date": "Tue, 27 Jun 2017 21:15:47 GMT",
"Etag": "\"359670651+gzip+ident\"",
"Expires": "Tue, 04 Jul 2017 21:15:47 GMT",
"Last-Modified": "Fri, 09 Aug 2013 23:54:35 GMT",
"Server": "ECS (sjc/4E52)",
"Vary": "Accept-Encoding",
"X-Cache": "HIT",
"Content-Length": "1270"
},
"missingHeaders": {
"Content-Security-Policy": "Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.",
"X-Frame-Options": "X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value \"x-frame-options: SAMEORIGIN\".",
"X-XSS-Protection": "X-XSS-Protection sets the configuration for the cross-site scripting filter built into most browsers. Recommended value \"X-XSS-Protection: 1; mode=block\".",
"X-Content-Type-Options": "X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is \"X-Content-Type-Options: nosniff\".",
"Referrer-Policy": "Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites."
},
"otherServices": {
"Secarma": "For cybersecurity testing, consultancy & training visit our sponsor Secarma."
},
"upcomingHeaders": {
"Expect-CT": "Expect-CT allows a site to determine if they are ready for the upcoming Chrome requirements and/or enforce their CT policy."
},
"additionalInformation": {
"Server": "Server value has been changed. Typically you will see values like \"Microsoft-IIS/8.0\" or \"nginx 1.7.2\"."
}
}