Website check
canva.com
In plain English
Canva's overall grade from this passive check is A (93 out of 100), which is a strong result. The most important item is the missing Content Security Policy, a browser setting that limits which scripts may run on the page; adding one would reduce the risk of injected code, and the owner should review it first. The missing CAA record is a minor, informational point that makes it slightly easier to be sure only approved certificate authorities issue certificates for the domain. Visitors do not need to take any action, and this check gives no reason for them to be worried.
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
No CAA record
CAA records limit which certificate authorities may issue certificates for canva.com, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up canva.com and connecting over HTTPS
- 03Connected over HTTPS: www.canva.com answered 403 after 1 redirect
- 04Certificate from Amazon, valid 58 more days (TLSv1.3)
- 05Read the security headers: HSTS, X-Frame-Options, nosniff, Referrer-Policy set; missing CSP
- 06Checked 1 cookie for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 93/100, grade A. Writing it up in plain English
Technical details (29)
- ip
- 104.16.103.112
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Amazon
- tls subject
- *.canva.com
- tls validTo
- 2026-12-19T23:59:59.000Z
- tls daysLeft
- 58
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf1.canva.com include:_spf2.canva.com include:_spf3.canva.com include:_spf4.canva.com include:_spf5.canva.com include:_spf6.canva.com include:_spf7.canva.com include:_spf8.canva.com include:_spf9.canva.com -all
- email apex
- canva.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:dmarc-reports@canva.com; ruf=mailto:dmarc-reports+forensics@canva.com; fo=1
- status
- 403
- cookies
- __cf_bm
- headers server
- cloudflare
- headers referrer-policy
- same-origin
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s...
- headers x-content-type-options
- nosniff
- headers strict-transport-security
- max-age=31536000; includeSubDomains; preload
- finalUrl
- https://www.canva.com/
- requests
- 4
- timingMs
- 195
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.