Website check
metamask.io
In plain English
metamask.io scores A+ (97/100). No serious problems found, but a few settings could be tightened, starting with X-Powered-By header reveals the platform.
X-Powered-By header reveals the platform
The header advertises what the site runs on, which helps attackers pick their tools.
How to fix: Remove the X-Powered-By header (for PHP, set expose_php = Off).
X-Powered-By: Next.js
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No CAA record
CAA records limit which certificate authorities may issue certificates for metamask.io, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
Technical details (30)
- ip
- 2606:4700:4405::ac40:93b5
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- metamask.io
- tls validTo
- 2026-12-24T11:13:07.000Z
- tls daysLeft
- 63
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf.google.com include:mailgun.org include:4795067.spf01.hubspotemail.net -all
- email apex
- metamask.io
- email dmarc
- v=DMARC1; p=reject; rua=mailto:re+5a3be5d07465@inbound.dmarcdigests.com
- status
- 200
- cookies
- __cf_bm
- headers server
- cloudflare
- headers x-powered-by
- Next.js
- headers x-frame-options
- DENY
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'self'; media-src 'self' https://*.twimg.com/ https://videos.ctfassets.net/; script-src 'self' 'wasm-unsafe-eval' https://cdn.segment.com https://www.gstatic.com https://platform.twitter.com https://js.hsforms.net https://www.google.com/recaptcha/enterprise.js https://google.com/recaptch...
- headers strict-transport-security
- max-age=15778476; includeSubDomains; preload
- finalUrl
- https://metamask.io/
- requests
- 3
- timingMs
- 796
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.