# Website Security Check — https://files.profullstack.com/~arion/public/index.html

- Scanned: 2026-09-23 12:52 UTC
- HTTP 200, 5 KB, 0.59s
- **Score: 9/15 — grade C**
- Scope: HTTP headers, TLS certificate/protocol, cookies, mixed content, common-port connect check, exposed-file probes. Non-intrusive review only — not a penetration test.

| Check | Result | Detail |
|-------|--------|--------|
| HTTPS reachable | PASS | scheme=https HTTP 200 |
| HTTP→HTTPS redirect | PASS | http://files.profullstack.com/ → 308 https://files.profullstack.com/ |
| TLS certificate | PASS | valid, 57 days left, issuer Let's Encrypt |
| TLS protocol | PASS | TLSv1.3, cipher TLS_AES_128_GCM_SHA256 |
| HSTS | FAIL | header missing |
| Content-Security-Policy | FAIL | header missing |
| Clickjacking protection | FAIL | neither X-Frame-Options nor frame-ancestors |
| X-Content-Type-Options | FAIL | missing |
| Referrer-Policy | FAIL | missing |
| Permissions-Policy | FAIL | missing |
| Cookie flags | PASS | no cookies set on this response |
| Version disclosure | PASS | no software versions exposed |
| Mixed content | PASS | none |
| Exposed ports | PASS | 22/SSH, 25/SMTP |
| Exposed sensitive files | PASS | no .env/.git/config backups found |

## Top recommendations

- **HSTS** — Add Strict-Transport-Security: max-age=31536000; includeSubDomains.
- **Content-Security-Policy** — Add a CSP to mitigate XSS/data-injection.
- **Clickjacking protection** — Add X-Frame-Options: DENY/SAMEORIGIN or CSP frame-ancestors.
- **X-Content-Type-Options** — Add X-Content-Type-Options: nosniff.
- **Referrer-Policy** — Add Referrer-Policy: strict-origin-when-cross-origin (or stricter).
- **Permissions-Policy** — Add Permissions-Policy to disable unused browser features.