Website check
pump.fun
In plain English
pump.fun scores A (90/100). The biggest issue: session cookies readable by scripts (plus 1 more).
Session cookies readable by scripts
Cookies that look like logins lack HttpOnly, so an injected script could steal them and take over accounts.
How to fix: Add HttpOnly to session and login cookies.
Cookies: pump_session_id
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-inline'
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No CAA record
CAA records limit which certificate authorities may issue certificates for pump.fun, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
Technical details (31)
- ip
- 2606:4700:4405::6812:2216
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- pump.fun
- tls validTo
- 2027-01-12T13:15:16.000Z
- tls daysLeft
- 82
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf.google.com -all
- email apex
- pump.fun
- email dmarc
- v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:748b9ebb798d42829981a4afa7d121ee@dmarc-reports.cloudflare.net;
- status
- 200
- cookies
- pump_session_id, pump_device_id, pump_locale, __cf_bm, _cfuvid
- headers server
- cloudflare
- headers referrer-policy
- same-origin
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'self';script-src 'self' 'wasm-unsafe-eval' https://*.appsflyer.com https://*.appsflyersdk.com https://*.awswaf.com https://vercel.live https://www.googletagmanager.com https://challenges.cloudflare.com https://unpkg.com https://*.cloudflareinsights.com https://www.tiktok.com https://lf1...
- headers strict-transport-security
- max-age=15552000; includeSubDomains
- finalUrl
- https://pump.fun/
- requests
- 3
- timingMs
- 1818
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- bodyTruncated
- true
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.