Website check
aliexpress.com
In plain English
Overall, this passive check gives aliexpress.com a B (71/100). The gaps are mostly missing browser safety settings (HSTS, Content Security Policy and a few cookie and header flags), not signs of a site that is broken or actively compromised. The most important fix is to turn on HSTS, which stops a visitor's first connection from being quietly downgraded to plain HTTP on hostile networks, and to add a Content Security Policy to limit which scripts can run. Visitors do not need to panic; the risk is real but mainly applies on untrusted Wi-Fi or if an attacker finds a separate weakness, and this check cannot tell us whether any of these gaps have been exploited.
No HSTS header
Without HSTS, a visitor's first connection can be quietly downgraded to plain HTTP on hostile Wi-Fi, exposing what they send.
How to fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response.
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: xman_us_f, acs_usuc_t, xman_t, xman_f
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: xman_us_f, acs_usuc_t, xman_t, xman_f
Page can be framed by other sites
Another site could load this page in a hidden frame and trick visitors into clicking things (clickjacking).
How to fix: Send X-Frame-Options: DENY (or SAMEORIGIN), or add a frame-ancestors rule to the Content Security Policy.
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No CAA record
CAA records limit which certificate authorities may issue certificates for aliexpress.com, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (10 steps)
- 01Picked up a daily rating check
- 02Looking up aliexpress.com and connecting over HTTPS
- 03Connected over HTTPS: www.aliexpress.us answered 302 after 6 redirects
- 04Certificate from GlobalSign nv-sa, valid 113 more days (TLSv1.3)
- 05Read the security headers: none set; missing HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy
- 06Checked 4 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Old TLS 1.0/1.1: refused
- 09Email spoofing protection: SPF set, DMARC set
- 10Scored 71/100, grade B. Writing it up in plain English
Technical details (25)
- ip
- 23.41.4.78
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- GlobalSign nv-sa
- tls subject
- *.aliexpress.us
- tls validTo
- 2027-02-13T05:21:30.000Z
- tls daysLeft
- 113
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:spf1.service.alibaba.com include:spf2.service.alibaba.com include:spf2.ocm.aliyun.com -all
- email apex
- aliexpress.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:dmarc-ap@service.alibaba.com; ruf=mailto:dmarc-ap@service.alibaba.com
- status
- 302
- cookies
- xman_us_f, acs_usuc_t, xman_t, xman_f
- headers server
- Tengine
- partial
- true
- finalUrl
- https://www.aliexpress.us/?gatewayAdapt=glo2usa&_randl_shipto=US
- requests
- 6
- timingMs
- 2693
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- not checked
- httpRedirect
- not checked
- redirectStopped
- too many redirects
- thirdPartyScripts
- 0
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.