Website check
robinhood.com
In plain English
robinhood.com scores A+ (97/100). No serious problems found, but a few settings could be tightened, starting with Content Security Policy allows unsafe scripts.
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-inline'
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (12 steps)
- 01Picked up a daily rating check
- 02Looking up robinhood.com and connecting over HTTPS
- 03Connected over HTTPS: robinhood.com answered 200 after 1 redirect
- 04Certificate from Amazon, valid 77 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06No PHP version given away
- 07Found 0 script sources from other sites
- 08Old TLS 1.0/1.1: refused
- 09Plain http:// redirects to HTTPS
- 10security.txt found
- 11Email spoofing protection: SPF set, DMARC set
- 12Scored 97/100, grade A+. Writing it up in plain English
Technical details (29)
- ip
- 13.224.181.76
- caa
- 0 issuewild "digicert.com", 0 issue "digicert.com", 0 issue "comodoca.com", 0 issue "letsencrypt.org", 0 issuewild "cloudflare.com", 0 issuewild "comodoca.com", 0 issuewild "letsencrypt.org", 0 issuewild "amazonaws.com", 0 issue "amazonaws.com", 0 issue "cloudflare.com"
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- Amazon
- tls subject
- robinhood.com
- tls validTo
- 2027-01-07T23:59:59.000Z
- tls daysLeft
- 77
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:152.70.150.118 a:outbound.email.robinhood.com include:mail.zendesk.com include:amazonses.com include:_spf.google.com include:spf.mandrillapp.com include:mg-spf.greenhouse.io include:aristotle.com exists:%{i}._spf.mta.salesforce.com ~all
- email apex
- robinhood.com
- email dmarc
- v=DMARC1; p=quarantine; rua=mailto:postmaster@robinhood.com; ruf=mailto:postmaster@robinhood.com; fo=0; adkim=r; aspf=r; rf=afrf
- status
- 200
- cookies
- headers server
- envoy
- headers referrer-policy
- strict-origin-when-cross-origin
- headers x-frame-options
- deny
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'none'; script-src 'self' cdn.robinhood.com cdn.pdst.fm/ping.min.js 'unsafe-inline' *.google-analytics.com *.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ tagmanager.google.com connect.facebook.net sc-static.net d.impactradius-event.com www.redditstatic.com an...
- headers strict-transport-security
- max-age=31536000, max-age=31536000
- finalUrl
- https://robinhood.com/us/en/
- requests
- 4
- timingMs
- 2889
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.