Website check
dexscreener.com
In plain English
Overall, dexscreener.com scores a B (83/100). The site is in reasonably good shape, with a few gaps that are worth closing. The most important fix is to turn off support for TLS 1.1 on the server and to add an HSTS header, since these two issues affect how safely a first visit is protected. Visitors do not need to be alarmed. These findings are about configuration hardening, not evidence that the site has been breached or that visitor data is currently exposed.
Old TLS versions still accepted
The server still accepts TLS 1.1, outdated encryption that browsers dropped in 2020 and that weakens protection for older devices.
How to fix: Turn off TLS 1.0 and 1.1 in the server or CDN settings and keep TLS 1.2 and 1.3.
TLSv1.1 with ECDHE-RSA-AES128-SHA
No HSTS header
Without HSTS, a visitor's first connection can be quietly downgraded to plain HTTP on hostile Wi-Fi, exposing what they send.
How to fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response.
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-eval'
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up dexscreener.com and connecting over HTTPS
- 03Connected over HTTPS: dexscreener.com answered 403
- 04Certificate from Google Trust Services, valid 47 more days (TLSv1.3)
- 05Read the security headers: CSP, X-Frame-Options, nosniff, Referrer-Policy set; missing HSTS
- 06Checked 1 cookie for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Plain http:// redirects to HTTPS
- 10Old TLS 1.0/1.1: still accepted
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 83/100, grade B. Writing it up in plain English
Technical details (30)
- ip
- 172.64.149.113
- caa
- 0 issue "comodoca.com", 0 issue "digicert.com; cansignhttpexchanges=yes", 0 issue "letsencrypt.org", 0 issue "pki.goog; cansignhttpexchanges=yes", 0 issue "ssl.com", 0 issuewild "comodoca.com", 0 issuewild "digicert.com; cansignhttpexchanges=yes", 0 issuewild "letsencrypt.org", 0 issuewild "pki.goog...
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- dexscreener.com
- tls validTo
- 2026-12-09T05:32:49.000Z
- tls daysLeft
- 47
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf.google.com include:amazonses.com include:sendgrid.net -all
- email apex
- dexscreener.com
- email dmarc
- v=DMARC1; p= reject; rua=mailto:bb9136852f4949b5bd9845db8a7552b2@dmarc-reports.cloudflare.net
- status
- 403
- cookies
- __cf_bm
- headers server
- cloudflare
- headers referrer-policy
- same-origin
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s...
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'none'; script-src 'nonce-NZL7XykG4EUE1gLOAssF59' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge...
- finalUrl
- https://dexscreener.com/
- requests
- 3
- timingMs
- 74
- reachable
- true
- redirects
- oldTlsProbe
- accepted
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.