Security
The Security score group: transport security, compromise signals, compliance, and blocked content
Security is one of the four score groups on every report. It spans four categories: transport and header hardening (this page), signs of compromise, legal compliance signals, and content blocked by ad blockers and privacy filters.
Categories
Signs of compromise: injected pages, phishing kits, malware, SEO spam (9 rules)
Privacy policy and legal compliance signals (4 rules)
Content, links, and trackers blocked by ad blockers and privacy filters (3 rules)
Security rules
HTTPS, headers, and safe link practices (16 rules).
Checks for Content-Security-Policy header and validates directives
Checks Set-Cookie response headers for Secure, HttpOnly, and SameSite attributes
Checks external target=_blank links for noopener (security) and noreferrer (privacy)
Checks for CAPTCHA protection on public forms
Checks that form actions use HTTPS
Checks for HTTP Strict Transport Security header
Checks whether HTTP URLs redirect to HTTPS
Checks for HTTPS usage
Checks for exposed API keys, secrets, and credentials in HTML/JS
Checks for HTTP resources on HTTPS pages
Checks for Permissions-Policy (Feature-Policy) header
Checks for Referrer-Policy header
Checks that cross-origin scripts and stylesheets use Subresource Integrity (SRI)
Detects third-party resources that may set cookies
Checks for MIME type sniffing protection
Checks for clickjacking protection header
Disable All Security Rules
[rules]
disable = ["security/*"]