Website check
stripe.com
In plain English
Overall, the site scores very well on this passive check, with an A+ grade (97/100). The most useful thing to address first is the low-severity issue: scripts loaded from other companies' servers lack integrity checks, so adding them (subresource integrity) would mean a compromised third-party server could not quietly change what runs on your pages. The missing Permissions-Policy header is informational and a smaller matter, but adding it lets you explicitly turn off camera, microphone and location access you don't use. Visitors do not need to be worried; these are minor hardening points, not signs of an active problem.
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
b.stripecdn.com
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up stripe.com and connecting over HTTPS
- 03Connected over HTTPS: stripe.com answered 200
- 04Certificate from DigiCert, Inc., valid 49 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 1 cookie for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 97/100, grade A+. Writing it up in plain English
Technical details (30)
- ip
- 198.137.150.231
- caa
- 0 issue "digicert.com", 0 issue "visa.com", 0 iodef "mailto:caa-violations@stripe.com", 0 issue "amazon.com"
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- DigiCert, Inc.
- tls subject
- stripe.com
- tls validTo
- 2026-12-10T23:59:59.000Z
- tls daysLeft
- 49
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all
- email apex
- stripe.com
- email dmarc
- v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;
- status
- 200
- cookies
- cid
- headers server
- nginx
- headers referrer-policy
- no-referrer-when-downgrade
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- headers content-security-policy
- base-uri 'none'; child-src 'none'; connect-src https://c.increment.com https://c.stripe.dev https://c.stripe.global https://c.stripe.partners blob: https://b.stripecdn.com https://errors.stripe.com https://ext.stripe.com https://r.stripe.com https://stripe-images.s3.us-west-1.amazonaws.com https://s...
- headers strict-transport-security
- max-age=63072000; includeSubDomains; preload
- finalUrl
- https://stripe.com/
- requests
- 3
- timingMs
- 266
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- b.stripecdn.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.