kijabehospital.org

2 of 8 checks passed.

✓ 2 passed ! 3 warnings ✕ 3 failed

Detailed findings

✓

Served over HTTPS with a valid certificate.

Fix: Good.

Missing strict-transport-security header.

Fix: Add Strict-Transport-Security to force HTTPS on future visits.

Missing content-security-policy header.

Fix: Add a Content-Security-Policy header to reduce XSS/injection risk.

Missing x-frame-options header.

Fix: Add X-Frame-Options: DENY (or CSP frame-ancestors) to prevent clickjacking.

Missing x-content-type-options header.

Fix: Add X-Content-Type-Options: nosniff.

Missing referrer-policy header.

Fix: Add a Referrer-Policy header (e.g. strict-origin-when-cross-origin).

Missing permissions-policy header.

Fix: Add a Permissions-Policy header to restrict browser features.

✓

No obvious version disclosure in Server header.

Fix: Good.

1 HSTS: Add Strict-Transport-Security to force HTTPS on future visits.
2 Content Security Policy: Add a Content-Security-Policy header to reduce XSS/injection risk.
3 X-Frame-Options / frame-ancestors: Add X-Frame-Options: DENY (or CSP frame-ancestors) to prevent clickjacking.
4 X-Content-Type-Options: Add X-Content-Type-Options: nosniff.
5 Referrer-Policy: Add a Referrer-Policy header (e.g. strict-origin-when-cross-origin).
6 Permissions-Policy: Add a Permissions-Policy header to restrict browser features.

Want these issues fixed?

Quepath can harden your email, DNS and web security end-to-end.

Talk to us

Automated analysis of public information. Not a substitute for a full security audit.