Website check
cloudflare.com
In plain English
Overall, cloudflare.com scored an A (88 out of 100). The check found four low-severity issues, and none of them is serious on its own. The most useful first fix is to set the Secure and SameSite flags on cookies, since that closes the main gap where cookies could be read over plain HTTP or sent along with requests from other sites. Visitors do not need to worry, but the site owner should tidy these items up to keep the score strong.
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: _ga
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: _ga
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-inline' 'unsafe-eval'
Page shows its software version
The page's generator tag names the software and version that built it, which helps attackers match it to known flaws.
How to fix: Remove the generator meta tag, or at least the version number in it.
generator: Astro v6.3.7
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up cloudflare.com and connecting over HTTPS
- 03Connected over HTTPS: www.cloudflare.com answered 200 after 1 redirect
- 04Certificate from Google Trust Services, valid 80 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 5 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 88/100, grade A. Writing it up in plain English
Technical details (30)
- ip
- 104.16.123.96
- caa
- 0 issue "digicert.com; cansignhttpexchanges=yes", 0 issue "letsencrypt.org", 0 issue "pki.goog; cansignhttpexchanges=yes", 0 issue "ssl.com", 0 issuewild "comodoca.com", 0 issuewild "digicert.com; cansignhttpexchanges=yes", 0 issuewild "letsencrypt.org", 0 issuewild "pki.goog; cansignhttpexchanges=y...
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- www.cloudflare.com
- tls validTo
- 2027-01-10T21:43:36.000Z
- tls daysLeft
- 80
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all
- email apex
- cloudflare.com
- email dmarc
- v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com
- status
- 200
- cookies
- _ga, cfz_google-analytics_v4, cfz_adobe, kndctr_8AD56F28618A50850A495FB6_AdobeOrg_identity, __cf_bm
- headers server
- cloudflare
- headers referrer-policy
- strict-origin-when-cross-origin
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- geolocation=(), camera=(), microphone=()
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflareinsights.com https://static-staging.cloudflareinsights.com https://challenges.cloudflare.com https://*.onetrust.com https://cdn.cookielaw.org https://ot.www.cloudflare.com https://www.googletagmanager.com ht...
- headers strict-transport-security
- max-age=31536000; includeSubDomains
- finalUrl
- https://www.cloudflare.com/
- requests
- 4
- timingMs
- 303
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- static.cloudflareinsights.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.