Website check
bing.com
In plain English
Overall, bing.com scored a B (81/100) on this passive check. That is a solid result with a few gaps to close. The most important fix is making the site redirect plain http:// visits to https://, so visitors are not left on an unencrypted connection. Visitors do not need to panic: the findings are mostly low-severity settings that tighten up cookies, browser behavior, and how security reports reach the team.
HTTP does not redirect to HTTPS
Visitors who type the address or follow an old http:// link stay on the unencrypted version of the site.
How to fix: Redirect every http:// request to the same https:// address with a 301.
http://www.bing.com/ returned 200
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: MUIDB, _EDGE_S, _EDGE_V, SRCHD, SRCHUID (+5 more)
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: MUIDB, _EDGE_S, _EDGE_V, SRCHD, SRCHUID (+5 more)
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up bing.com and connecting over HTTPS
- 03Connected over HTTPS: www.bing.com answered 200 after 1 redirect
- 04Certificate from Microsoft Corporation, valid 187 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options set; missing nosniff, Referrer-Policy
- 06Checked 13 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// does not redirect to HTTPS
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 81/100, grade B. Writing it up in plain English
Technical details (27)
- ip
- 23.219.78.141
- caa
- 0 issue "microsoft.com", 0 other "", 0 issue "digicert.com", 0 issue "globalsign.com"
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Microsoft Corporation
- tls subject
- r.bing.com
- tls validTo
- 2027-04-28T01:47:41.000Z
- tls daysLeft
- 187
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:spf.protection.outlook.com -all
- email apex
- bing.com
- email dmarc
- v=DMARC1; p=reject; pct=100; rua=mailto:BingEmailDMARC@microsoft.com;
- status
- 200
- cookies
- MUID, MUIDB, _EDGE_S, _EDGE_V, __Host-XY, SRCHD, SRCHUID, SRCHUSR, SRCHHPGUSR, _SS, _HPVN, ak_bmsc
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- unload=()
- headers content-security-policy
- script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-tfWF0ZoOnNw7BVHScCYCeis+m9zbQjCvKDYCV48bwFE='; base-uri 'self';
- headers strict-transport-security
- max-age=31536000; includeSubDomains; preload
- finalUrl
- https://www.bing.com/?toWww=1&redig=E07218CCD0654DEB867FE572CABF1322
- requests
- 5
- timingMs
- 282
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- answers over http (status 200)
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.