Website check
zoom.us
In plain English
Overall, this passive check gives zoom.us a B (84/100). The main gap is the missing Content Security Policy, which is the most important thing to fix first. It limits which scripts can run on the page, so adding one would make it harder for injected code to steal logins or change what visitors see. The other findings are lower risk: missing protections against the page being framed by other sites, a browser file-type guess setting, unchecked third-party scripts, and a few missing headers and contact details for reporting problems. Based only on these findings, visitors do not need to take immediate action. This check does not confirm whether any attack has happened or is happening.
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
Page can be framed by other sites
Another site could load this page in a hidden frame and trick visitors into clicking things (clickjacking).
How to fix: Send X-Frame-Options: DENY (or SAMEORIGIN), or add a frame-ancestors rule to the Content Security Policy.
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
st1.zoom.us, cdn.optimizely.com, cdn.bc0a.com (+1 more)
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up zoom.us and connecting over HTTPS
- 03Connected over HTTPS: www.zoom.com answered 200 after 1 redirect
- 04Certificate from DigiCert Inc, valid 78 more days (TLSv1.3)
- 05Read the security headers: HSTS set; missing CSP, X-Frame-Options, nosniff, Referrer-Policy
- 06Checked 1 cookie for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 5 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 84/100, grade B. Writing it up in plain English
Technical details (25)
- ip
- 170.114.78.80
- caa
- 0 iodef "mailto:security@zoom.us", 0 issue "amazon.com", 0 issue "digicert.com", 0 issue "godaddy.com", 0 issue "letsencrypt.org", 0 issue "pki.goog", 0 issue "sectigo.com"
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- DigiCert Inc
- tls subject
- www.zoom.com
- tls validTo
- 2027-01-08T23:59:59.000Z
- tls daysLeft
- 78
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com include:_spf.google.com include:amazonses.com ip4:52.38.191.241 include:servers.mcsv.net include:_spf.salesforce.com ip4:13.110.78.0/24 ~all
- email apex
- zoom.us
- email dmarc
- v=DMARC1;p=reject;ri=3600;rua=mailto:sesbounce@zoom.us,mailto:dmarc_rua@emaildefense.proofpoint.com;
- status
- 200
- cookies
- __cf_bm
- headers server
- cloudflare
- headers strict-transport-security
- max-age=15552000; includeSubDomains
- finalUrl
- https://www.zoom.com/
- requests
- 4
- timingMs
- 327
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 5
- thirdPartyScriptHosts
- st1.zoom.us, cdn.optimizely.com, cdn.cookielaw.org, cdn.bc0a.com, us01ccistatic.zoom.us
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.