Technical checks
Security checks
Use SSL if you are interacting with sensitive user data. You’ll find 14 checks in this group.
| State | Evidence | Owner |
|---|---|---|
| Found | SecurityOriginal page and available evidence recorded | Audit |
| Reviewed | Decision recordedA person checked the target and proposed value | Human |
| Checked | Public page readLive result recorded separately | Netrix |
All checks in this group
Open a check to see what triggered it and what to do next.
Security
Use SSL if you are interacting with sensitive user data.
Mixed Content Issues
HTTPS pages loading HTTP resources cause security warnings. Update all resources to HTTPS.
Form URL Insecure
Forms should submit data to HTTPS URLs to protect user information in transit.
Form on HTTP URL
Pages containing forms should use HTTPS to establish trust and protect data.
Missing HSTS Header
Add Strict-Transport-Security header to force HTTPS connections and prevent downgrade attacks.
Unsafe Cross-Origin Links
Add rel="noopener noreferrer" to external links opening in new tabs to prevent security vulnerabilities.
Protocol-Relative Resource Links
Replace protocol-relative URLs (//example.com) with explicit HTTPS URLs for better security.
Missing Content-Security-Policy Header
Implement Content-Security-Policy header to prevent XSS attacks and control resource loading.
Missing X-Content-Type-Options Header
Add X-Content-Type-Options: nosniff header to prevent MIME type sniffing attacks.
Missing X-Frame-Options Header
Add X-Frame-Options header to prevent clickjacking attacks.
Missing Referrer-Policy Header
Add Referrer-Policy header to control referrer information sent with requests.
Bad Content Type
Ensure all resources are served with appropriate Content-Type headers to prevent security issues.
Mixed Content
An HTTPS page requesting HTTP resources shows a browser warning and can have those resources blocked outright. Serve every asset over HTTPS.
Insecure Resource Dependency (Manual Review)
Update the URL in its owning stylesheet, responsive image markup or redirect. A page-level HTML attribute rewrite does not repair this dependency. Older evidence without direct-reference provenance also requires manual inspection.