Website check
yahoo.com
In plain English
Yahoo.com scored A+ (97/100) on this passive check, so the site's basic protections are in good shape. The main thing to fix first is the Content Security Policy, which has no rule limiting where scripts can load from, so it does not currently block injected scripts; adding a script-src or default-src rule would close that gap. The missing Permissions-Policy header is a minor, informational item and visitors have no reason to be worried.
Content Security Policy does not limit scripts
The policy has no script-src or default-src rule, so it does nothing to stop injected scripts.
How to fix: Add a script-src (or default-src) rule that lists only the sources the site uses.
frame-ancestors 'self' https://*.builtbygirls.com https://*.rivals.com https://*.engadget.com https://*.intheknow.com ht...
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up yahoo.com and connecting over HTTPS
- 03Connected over HTTPS: www.yahoo.com answered 200 after 1 redirect
- 04Certificate from DigiCert Inc, valid 27 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, nosniff, Referrer-Policy set; missing X-Frame-Options
- 06Checked 3 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10security.txt found
- 11Plain http:// redirects to HTTPS
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 97/100, grade A+. Writing it up in plain English
Technical details (28)
- ip
- 69.147.80.15
- caa
- 0 issue "sectigo.com", 0 iodef "mailto:security@yahooinc.com", 0 issue "digicert.com", 0 issue "globalsign.com"
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- DigiCert Inc
- tls subject
- *.www.yahoo.com
- tls validTo
- 2026-11-18T23:59:59.000Z
- tls daysLeft
- 27
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 redirect=_spf.mail.yahoo.com
- email apex
- yahoo.com
- email dmarc
- v=DMARC1; p=reject; pct=100; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;
- status
- 200
- cookies
- A1, A3, A1S
- headers server
- ATS
- headers referrer-policy
- no-referrer-when-downgrade
- headers x-content-type-options
- nosniff
- headers content-security-policy
- frame-ancestors 'self' https://*.builtbygirls.com https://*.rivals.com https://*.engadget.com https://*.intheknow.com https://*.autoblog.com https://*.yahoo.com https://*.aol.com https://*.huffingtonpost.com https://*.oath.com https://*.search.yahoo.com https://*.pnr.ouryahoo.com https://pnr.ouryaho...
- headers strict-transport-security
- max-age=31536000
- finalUrl
- https://www.yahoo.com/
- requests
- 4
- timingMs
- 984
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.