Insights
Security
See an A to F security grade for every host, with checks for HSTS, CSP, nosniff, clickjacking, cookie flags, risky CORS, version disclosure and plain HTTP.
The Security tab audits the responses from each host for security headers and cookie hygiene, and gives every host a score out of 100 and a grade from A to F. It checks for HSTS, a Content Security Policy, nosniff, clickjacking protection, Secure, HttpOnly and SameSite cookie flags, risky CORS settings, software version disclosure and unencrypted HTTP. Use it to review your own backend before a release, or to explain to a team why a header matters.
Hosts are listed worst first. Select one to see each issue and the requests that caused it.
- The host's grade, with its issue and response counts
- The host's score out of 100
- Each issue's severity
- Show the requests that triggered the issue
Review a host
Section titled “Review a host”- Open Insights with ⌥ ⌘ I and click Security.
- Pick a host in the list on the left. Hosts are sorted by score, lowest first, and the worst host is selected when the tab opens. Each row shows the grade, the host, and a count such as 8 issues · 3 responses.
- Read the issues on the right. Each one has a severity, a title and an explanation. A host with no issues says Every check passed.
- Click Show Request (or Show N Requests) on an issue to select the responses that triggered it in the main window. Up to 200 requests are kept per issue.
If no responses have been captured, the tab says No responses to audit.
How grades are calculated
Section titled “How grades are calculated”Each host starts at a score of 100. Every distinct issue subtracts points by severity:
| Severity | Points subtracted |
|---|---|
| High | 25 |
| Medium | 10 |
| Low | 3 |
An issue counts once per host no matter how many responses show it. Cookie and header issues count once per cookie or header name, so two cookies without Secure are two issues. The score never goes below 0.
The grade comes from the score:
| Grade | Score | Color |
|---|---|---|
| A | 90 to 100 | Green |
| B | 80 to 89 | Mint |
| C | 65 to 79 | Yellow |
| D | 50 to 64 | Orange |
| F | Below 50 | Red |
For example, a host with four Medium issues and four Low issues scores 100 − 40 − 12 = 48, an F.
The Worst security grade card on the Overview shows the lowest grade of any host.
Every check
Section titled “Every check”Each check runs on every response from the host. Responses are grouped by host name, in lowercase.
Transport
Section titled “Transport”| Issue | Severity | When it’s reported |
|---|---|---|
| Unencrypted HTTP | Medium | A request to the host used http. |
| Missing Strict-Transport-Security | Medium | An HTTPS response with a status from 200 to 399 has no Strict-Transport-Security header. |
| Short HSTS max-age | Low | Strict-Transport-Security has a max-age below 15,552,000 seconds (180 days). |
Local hosts are exempt from these three checks: localhost, addresses starting with 127., ::1, and names ending in .local or .localhost.
Content headers
Section titled “Content headers”| Issue | Severity | When it’s reported |
|---|---|---|
| Missing Content-Security-Policy | Medium | An HTML response (Content-Type containing text/html) has no Content-Security-Policy. |
| Clickjacking protection missing | Low | An HTML response has no X-Frame-Options and its CSP has no frame-ancestors directive. |
| Missing X-Content-Type-Options | Low | A response with a Content-Type doesn’t have X-Content-Type-Options: nosniff. |
| Issue | Severity | When it’s reported |
|---|---|---|
| CORS allows any origin with credentials | High | Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true. |
| CORS trusts the null origin | High | The request’s Origin was null, the response echoed Access-Control-Allow-Origin: null, and credentials are allowed. Sandboxed iframes and local files send Origin: null. |
| CORS wildcard on authenticated API | Medium | Access-Control-Allow-Origin: * on a response to a request that carried an Authorization header. |
Version disclosure
Section titled “Version disclosure”| Issue | Severity | When it’s reported |
|---|---|---|
| Software version disclosed | Low | Server, X-Powered-By, X-AspNet-Version or X-AspNetMvc-Version contains a digit, such as Server: Apache/2.4.29. Reported once per header name. |
Cookies
Section titled “Cookies”These checks run on every Set-Cookie header. A cookie being deleted (Max-Age=0) is skipped. A cookie counts as a session cookie when its name contains sess, auth, token, sid, login, jwt or remember, in any case.
| Issue | Severity | When it’s reported |
|---|---|---|
| Cookie without Secure | Medium for a session cookie, Low otherwise | Set over HTTPS without the Secure attribute, so it can also be sent over plain HTTP. |
| Session cookie readable by scripts | Medium | A session cookie without HttpOnly, so injected JavaScript can read it. |
| Cookie without SameSite | Low | No SameSite attribute, so the browser’s default applies to cross-site requests. |
| SameSite=None without Secure | Medium | SameSite=None without Secure. Browsers reject such cookies. |
Each cookie issue names the cookie in its explanation and is counted once per cookie name.
Security in the report and over MCP
Section titled “Security in the report and over MCP”The Markdown report has a Security headers table with every host’s grade and a list of its issues. The MCP server’s insights tool returns each host’s audit, including score and issues, with section set to security. See Insights report.