Loading…
Security Audit
https://www.sitevitals.co.uk
Public Share Link
Anyone with this link can view this dashboard. The link expires in 24 hours.
Security Score
Excellent
Good posture. Fix the remaining issues below to reach full compliance.
Headers, JavaScript, software & more
Top priorities
Issues with the most impact on your site's security.
No critical issues! Nice work.
Inline Action Triggers
Inline event handlers detected. These can make a strict Content Security Policy harder to implement and should be reviewed: onload=, onclick=
Xsrf Token
HttpOnly flag missing; SameSite is lax, consider strict
Content Guardian (CSP)
Your guard is active, but it uses "unsafe-inline" or "unsafe-eval". To meet 2026 security standards, consider implementing cryptographic Nonces to lock down your scripts further.
Old-School Script Filter (XSS)
This older safety check is missing. This is not critical as long as your "Content Guardian (CSP)" is robust.
Device & Feature Privacy
No policy detected; by default, the site could request access to a user's camera, location, or biometric sensors.
HTTP to HTTPS Redirect
Site automatically redirects insecure traffic to HTTPS.
Legacy URL Scripts
No "javascript:" URLs were found in your links.
Encoded Script Detection
No encoded script bypasses detected.
Hexadecimal Masking
No hex-obfuscated code was found.
Base64 Masking
No Base64-encoded scripts were detected.
Execution Safety (eval)
The dangerous "eval()" function is not being used.
Suspicious Inline Code
No suspicious inline code patterns were found.
Safe Timers (setTimeout)
Timers are being used safely with function references.
Safe Loops (setInterval)
Repeating timers are configured securely.
Dynamic Function Safety
No dynamic function constructors are in use.
Page Writing Safety
Modern, safe page update methods are being used.
Sitevitals Session
SameSite is lax, consider strict
Cloudflare
Up to date
Enforced Encryption (HSTS)
Encrypted connections are strictly enforced for 2026 compliance.
Data Leakage Protection
Your visitors’ data stays private when they leave your site.
Clickjack Protection
Your site cannot be invisible-framed by others. Your interface belongs to you.
File Type Sniffing
Browsers are forced to respect the actual file type, preventing "mime-sniffing" attacks.
Iframe integrity
No actionable issues detected.
Automatic Redirects
No forced auto-redirects found.
Mixed Content Check
All resources are loaded securely over HTTPS.
Sign up for free
Get free uptime checking, full reports for SEO and AI, page speed, and regression alerts.
Get Started for FreeReady to unlock full access?