Website check
laravel.com
In plain English
Overall, this passive check gives laravel.com a B (80/100). The findings are mostly about hardening: a few missing browser security headers, one header that reveals the platform, and some third-party scripts without integrity checks. The most important fix is to add HSTS so that browsers always use HTTPS for this site, which closes the risk of a visitor being quietly downgraded to plain HTTP on hostile Wi-Fi. Visitors do not need to be alarmed, since none of these findings is a confirmed active compromise, but the site owner should work through the medium items first and then the low and informational ones.
No HSTS header
Without HSTS, a visitor's first connection can be quietly downgraded to plain HTTP on hostile Wi-Fi, exposing what they send.
How to fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response.
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
cdn.usefathom.com, analytics.ahrefs.com, bzrcdn.openai.com
X-Powered-By header reveals the platform
The header advertises what the site runs on, which helps attackers pick their tools.
How to fix: Remove the X-Powered-By header (for PHP, set expose_php = Off).
X-Powered-By: Statamic
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
No CAA record
CAA records limit which certificate authorities may issue certificates for laravel.com, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up laravel.com and connecting over HTTPS
- 03Connected over HTTPS: laravel.com answered 200
- 04Certificate from Google Trust Services, valid 75 more days (TLSv1.3)
- 05Read the security headers: X-Frame-Options, nosniff, Referrer-Policy set; missing HSTS, CSP
- 06Checked 4 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 4 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 80/100, grade B. Writing it up in plain English
Technical details (29)
- ip
- 104.18.3.81
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- laravel.com
- tls validTo
- 2027-01-05T19:54:41.000Z
- tls daysLeft
- 75
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf.google.com include:helpscoutemail.com include:servers.mcsv.net ~all
- email apex
- laravel.com
- email dmarc
- v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:6dea021493b141db9aa5947655763aeb@dmarc-reports.cloudflare.net,mailto:dmarc@laravel.com; aspf=r; pct=100
- status
- 200
- cookies
- XSRF-TOKEN, laravelcom_session, fcDJydTHxuC15OQX4EIqyPEOjHz4pLcLi83iNsQC, __cf_bm
- headers server
- cloudflare
- headers x-powered-by
- Statamic
- headers referrer-policy
- no-referrer-when-downgrade
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- finalUrl
- https://laravel.com/
- requests
- 3
- timingMs
- 810
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 4
- thirdPartyScriptHosts
- cdn.usefathom.com, analytics.ahrefs.com, js.hs-scripts.com, bzrcdn.openai.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.