Website check
stackoverflow.com
In plain English
Overall, stackoverflow.com scores an A (90/100) on this passive check, which is a strong result. The most important fix is to add an HSTS header, which tells browsers to always use the encrypted HTTPS connection and blocks the chance of a first visit being downgraded to plain HTTP on hostile Wi-Fi. Visitors do not need to be worried: the check found no active problem, and the other items are a tighter content security policy and a security.txt file so researchers know where to report issues.
No HSTS header
Without HSTS, a visitor's first connection can be quietly downgraded to plain HTTP on hostile Wi-Fi, exposing what they send.
How to fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response.
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-eval'
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up stackoverflow.com and connecting over HTTPS
- 03Connected over HTTPS: stackoverflow.com answered 403 after 1 redirect
- 04Certificate from Let's Encrypt, valid 81 more days (TLSv1.3)
- 05Read the security headers: CSP, X-Frame-Options, nosniff, Referrer-Policy set; missing HSTS
- 06Checked 1 cookie for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 90/100, grade A. Writing it up in plain English
Technical details (29)
- ip
- 198.252.206.1
- caa
- 0 issuewild "digicert.com; cansignhttpexchanges=yes", 0 issuewild "letsencrypt.org", 0 issuewild "pki.goog; cansignhttpexchanges=yes", 0 issuewild "sectigo.com", 0 issuewild "ssl.com", 128 iodef "mailto:sysadmin-team@stackoverflow.com", 0 issue "comodoca.com", 0 issue "digicert.com; cansignhttpexcha...
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Let's Encrypt
- tls subject
- stackoverflow.com
- tls validTo
- 2027-01-11T12:11:49.000Z
- tls daysLeft
- 81
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:52.38.191.241 include:_spf.google.com include:mailgun.org include:sendgrid.net include:mail.zendesk.com include:spf.tipalti.com ~all
- email apex
- stackoverflow.com
- email dmarc
- v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-aggregates@stackoverflow.com; ruf=mailto:dmarc-forensics@stackoverflow.com; fo=1
- status
- 403
- cookies
- __cf_bm
- headers server
- cloudflare
- headers referrer-policy
- same-origin
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s...
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'none'; script-src 'nonce-PVinr5ZR75lPDX5VnknxCF' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge...
- finalUrl
- https://stackoverflow.com/questions
- requests
- 4
- timingMs
- 364
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.