Security
Mixed content and the response headers a browser expects from a site served over HTTPS.
The server lists a directory instead of serving a page
Turn off automatic directory indexes on the server: the listing names files that were never meant to be addresses.
- Id
- DIRECTORY_LISTING_EXPOSED
- Fix estimate
- 15 min per page
A form on a secure page posts over http
Point the form’s action at the https address: browsers warn before sending it and Chrome refuses outright, so the form is both unsafe and broken.
- Id
- INSECURE_FORM_ACTION
- Fix estimate
- 15 min per page
A string that looks like a live key is in the page source
Revoke the key, issue a new one and keep it on the server — the page source is public, so never print a secret into HTML or inline JavaScript.
- Id
- SECRET_IN_HTML
- Fix estimate
- 30 min per page
TLS certificate expiring soon
Renew the certificate and confirm automatic renewal is running: when it lapses, every browser blocks the site outright.
- Id
- SSL_CERT_EXPIRING
- Fix estimate
- 20 min per page
Cookies set without Secure, HttpOnly or SameSite
Set Secure, HttpOnly and SameSite on the cookies the site issues, so they cannot travel over http, be read by a script, or be sent from another site.
- Id
- INSECURE_COOKIE_FLAGS
- Fix estimate
- 20 min per page
No contact, about or privacy page
Publish and link a contact page, an about page and a privacy policy: buyers and quality raters both look for them first.
- Id
- MISSING_TRUST_PAGES
- Fix estimate
- 20 min per page
Mixed content on a secure page
Change http:// asset URLs (images, scripts, styles) to https:// so browsers stop warning.
- Id
- MIXED_CONTENT
- Fix estimate
- 10 min per page
Redirect passes through plain http
Send every hop straight to its https address; a chain that ends secure can still travel in the clear.
- Id
- REDIRECT_DOWNGRADES_TO_HTTP
- Fix estimate
- 10 min per page
No verifiable business details on the site
Put a phone number, a postal address and a company or VAT number where a reader can see them, usually in the footer.
- Id
- MISSING_BUSINESS_IDENTITY
- Fix estimate
- 15 min per page
Missing security header
- Id
- MISSING_SECURITY_HEADER
- Fix estimate
- 15 min per page
Server reveals software version details
Hide the server version and X-Powered-By header — version strings help attackers pick exploits.
- Id
- SERVER_SIGNATURE_EXPOSED
- Fix estimate
- 10 min per page