Website check
nytimes.com
In plain English
Overall, nytimes.com scored a B (82 out of 100). All six findings are rated low, so this is a passive check that found no serious problems. The most useful first fix is setting the Secure and SameSite flags on cookies, since that is a quick change that closes the most direct risks to user sessions. Visitors do not need to be worried, but the site owner should work through the list in order of severity.
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: nyt-gdpr, nyt-geo, nyt-s-present
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: nyt-gdpr, nyt-geo, nyt-s-present
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-inline' 'unsafe-eval'
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
ct.captcha-delivery.com
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up nytimes.com and connecting over HTTPS
- 03Connected over HTTPS: www.nytimes.com answered 403 after 1 redirect
- 04Certificate from DigiCert Inc, valid 148 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options set; missing nosniff, Referrer-Policy
- 06Checked 9 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 82/100, grade B. Writing it up in plain English
Technical details (28)
- ip
- 151.101.21.164
- caa
- 0 issue "certainly.com", 0 issue "comodoca.com", 0 issue "digicert.com", 0 issue "letsencrypt.org", 0 issue "pki.goog", 0 issue "symantec.com", 0 issue "amazon.com", 0 issue "amazonaws.com", 0 issue "amazontrust.com", 0 issue "awstrust.com"
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- DigiCert Inc
- tls subject
- nytimes.com
- tls validTo
- 2027-03-19T23:59:59.000Z
- tls daysLeft
- 148
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:nytimes.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:_spf.e.sparkpost.com include:amazonses.com ~all
- email apex
- nytimes.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email,mailto:dmarc.report@nytimes.com
- status
- 403
- cookies
- datadome, nyt-a, nyt-gdpr, nyt-purr, nyt-geo, nyt.et.dd, nyt-s-present, nyt-traceid
- headers server
- DataDome
- headers x-frame-options
- DENY
- headers permissions-policy
- browsing-topics=()
- headers content-security-policy
- upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https: nytresource:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: nytresource:; style-src data: 'unsafe-inline' https: nytresource:; img-src data: https: blob: android-webview-video-poster: nytresource:; font-s...
- headers strict-transport-security
- max-age=63072000; includeSubDomains; preload
- finalUrl
- https://www.nytimes.com/
- requests
- 4
- timingMs
- 243
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- ct.captcha-delivery.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.