Website check
reddit.com
In plain English
reddit.com scores A (94/100). No serious problems found, but a few settings could be tightened, starting with cookies without a SameSite setting.
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: edgebucket
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
Technical details (28)
- ip
- 151.101.65.140
- caa
- 0 issue "digicert.com; cansignhttpexchanges=yes", 0 issue "pki.goog"
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- DigiCert Inc
- tls subject
- *.reddit.com
- tls validTo
- 2027-02-16T23:59:59.000Z
- tls daysLeft
- 117
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:spf0.reddit.com -all
- email apex
- reddit.com
- email dmarc
- v=DMARC1; p=reject; fo=1; ruf=mailto:reddit@us.cp-dmarc.com; rua=mailto:reddit@us.cp-dmarc.com
- status
- 200
- cookies
- edgebucket
- headers server
- snooserv
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'none'; script-src 'nonce-4f955e68-fbb0-4c65-b098-fd6d4a46c446'; style-src 'unsafe-inline'; img-src https://www.redditstatic.com; form-action 'self';
- headers strict-transport-security
- max-age=31536000; includeSubdomains
- finalUrl
- https://www.reddit.com/
- requests
- 4
- timingMs
- 389
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.