Website check
x.com
In plain English
Overall, this passive check gave x.com a top grade of A+ (100/100), with only two informational notes and no serious problems found. The first thing to consider is adding a Permissions-Policy header, which lets the site turn off features like the camera, microphone and location, and the second is adding a CAA record to limit which certificate authorities can issue certificates for the domain. Visitors do not need to be worried based on these results, since both items are minor hardening steps rather than active risks.
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No CAA record
CAA records limit which certificate authorities may issue certificates for x.com, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up x.com and connecting over HTTPS
- 03Connected over HTTPS: x.com answered 200
- 04Certificate from Let's Encrypt, valid 66 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 7 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 100/100, grade A+. Writing it up in plain English
Technical details (30)
- ip
- 172.66.0.227
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Let's Encrypt
- tls subject
- *.x.com
- tls validTo
- 2026-12-27T20:09:53.000Z
- tls daysLeft
- 66
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:199.16.156.0/22 ip4:199.59.148.0/22 include:_spf.google.com include:_spf.salesforce.com include:_oerp.x.com include:phx1.rp.oracleemaildelivery.com include:iad1.rp.oracleemaildelivery.com -all
- email apex
- x.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:caf935f12c8645b2921b0749d1fcd49e@dmarc-reports.cloudflare.net
- status
- 200
- cookies
- guest_id_marketing, guest_id_ads, gt, personalization_id, guest_id, __cf_bm
- headers server
- cloudflare envoy
- headers referrer-policy
- strict-origin-when-cross-origin
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'self';script-src 'self' 'nonce-+6Q+zqRy3o2ilW2zWav/Vg==' 'unsafe-inline' 'wasm-unsafe-eval' 'report-sample' https://*.twimg.com https://abs.twimg.com https://accounts.google.com/gsi/client https://appleid.cdn-apple.com https://*.stripe.com https://cdn.plaid.com/link/v2/stable/link-initi...
- headers strict-transport-security
- max-age=631138519; includeSubdomains
- finalUrl
- https://x.com/
- requests
- 3
- timingMs
- 399
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.