Website check
pinterest.com
In plain English
Overall, pinterest.com scored an A (91/100), which is a strong result from this passive check. The most useful next step for the site owner is to set the Secure and SameSite flags on cookies, since that closes the main gaps on the cookie side, and to add integrity checks to third-party scripts. Visitors do not need to be worried: the findings are all low or informational, and none of them shows an active break-in or stolen data.
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: _routing_id
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: _auth, _routing_id
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
s.pinimg.com
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up pinterest.com and connecting over HTTPS
- 03Connected over HTTPS: www.pinterest.com answered 200 after 1 redirect
- 04Certificate from DigiCert Inc, valid 127 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 5 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Plain http:// redirects to HTTPS
- 10Old TLS 1.0/1.1: refused
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 91/100, grade A. Writing it up in plain English
Technical details (28)
- ip
- 23.45.73.12
- caa
- 0 issue "digicert.com; cansignhttpexchanges=yes"
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- DigiCert Inc
- tls subject
- *.pinterest.com
- tls validTo
- 2027-02-26T23:59:59.000Z
- tls daysLeft
- 127
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 redirect=_spf.pinterest.com
- email apex
- pinterest.com
- email dmarc
- v=DMARC1; p=reject; fo=1; pct=100; rua=mailto:o4khm-8732@rua.dmarc.emailanalyst.com; ruf=mailto:o4khm-8732@ruf.dmarc.emailanalyst.com
- status
- 200
- cookies
- csrftoken, _pinterest_sess, _auth, _routing_id, tst
- headers referrer-policy
- origin
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'self' blob: s.pinimg.com s1.pinimg.com s2.pinimg.com; font-src 'self' m.media-amazon.com *.amazon-adsystem.com s.pinimg.com s1.pinimg.com s2.pinimg.com data: fonts.googleapis.com fonts.gstatic.com use.typekit.net; style-src 'self' blob: 'unsafe-inline' data: *.pinimg.com *.pinterest.com...
- headers strict-transport-security
- max-age=31536000 ; includeSubDomains ; preload
- finalUrl
- https://www.pinterest.com/
- requests
- 4
- timingMs
- 531
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- s.pinimg.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.