Website check
paypal.com
In plain English
paypal.com scores A (94/100). No serious problems found, but a few settings could be tightened, starting with cookies without a SameSite setting.
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: LANG, ts, ts_c
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
Technical details (27)
- ip
- 151.101.65.21
- caa
- 0 issue "quovadisglobal.com", 0 issue "visa.com", 0 issue "digicert.com"
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- DigiCert Inc
- tls subject
- www.paypal.com
- tls validTo
- 2027-03-14T23:59:59.000Z
- tls daysLeft
- 143
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:pp._spf.paypal.com include:3ph1._spf.paypal.com include:3ph2._spf.paypal.com include:3ph3._spf.paypal.com include:3ph4._spf.paypal.com include:sendgrid.net include:aspmx.pardot.com ~all
- email apex
- paypal.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email; ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email
- status
- 200
- cookies
- LANG, ts, ts_c
- headers permissions-policy
- ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "h...
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-YjNmZTgyZWYtZjE2ZS00NTdlLWIyZTktODEzN2NiNDRhZDhi' 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobje...
- headers strict-transport-security
- max-age=63072000; includeSubDomains; preload
- finalUrl
- https://www.paypal.com/au/home
- requests
- 6
- timingMs
- 1256
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- www.paypalobjects.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.