Results forbaidu.com.cn

13 Issues Found

• Missing: content-security-policy

  Recommendation: Controls resources the browser can load. Prevents XSS.

• Missing: x-content-type-options

  Recommendation: Prevents MIME type sniffing. Should be 'nosniff'.

• Missing: x-frame-options

  Recommendation: Controls framing. Use CSP frame-ancestors instead.

• Missing: referrer-policy

  Recommendation: Controls referrer info. Recommended: strict-origin-when-cross-origin

• Missing: permissions-policy

  Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()

• Missing: cross-origin-opener-policy

  Recommendation: Controls cross-origin window access. Recommended: same-origin

• Missing: cross-origin-resource-policy

  Recommendation: Controls cross-origin resource access. Recommended: same-origin

• Missing: cross-origin-embedder-policy

  Recommendation: Controls cross-origin embedding. Recommended: require-corp

• Missing: cache-control

  Recommendation: Caching policy. Use no-store/private for sensitive pages.

• Missing recommended header: content-security-policy

  Recommendation: Review and fix this security issue

• Missing recommended header: x-content-type-options

  Recommendation: Review and fix this security issue

• Missing recommended header: referrer-policy

  Recommendation: Review and fix this security issue

• HSTS max-age is too low: 172800 seconds (recommended: >= 31536000)

  Recommendation: Review and fix this security issue