Website check
duckduckgo.com
In plain English
duckduckgo.com scores A+ (97/100). No serious problems found, but a few settings could be tightened, starting with Content Security Policy allows unsafe scripts.
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-inline' 'unsafe-eval'
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
Technical details (31)
- ip
- 20.43.111.112
- caa
- 0 issue "letsencrypt.org", 0 issue "digicert.com"
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- DigiCert Inc
- tls subject
- *.duckduckgo.com
- tls validTo
- 2026-11-19T23:59:59.000Z
- tls daysLeft
- 28
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:mail.duckduckgo.com include:spf.mailer.duckduckgo.com include:spf.protection.outlook.com include:duck.com include:mail.zendesk.com -all
- email apex
- duckduckgo.com
- email dmarc
- v=DMARC1; p=reject; pct=100; rua=mailto:n1um42s6@ag.dmarcian.com
- status
- 200
- cookies
- headers server
- nginx
- headers referrer-policy
- origin
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- interest-cohort=()
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'none' ; connect-src https://duck.ai https://*.duck.ai https://duckduckgo.com https://*.duckduckgo.com https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com ; manifest-src https://duck.ai https://*.duck.ai https://duckduckgo.com https://*.duc...
- headers strict-transport-security
- max-age=31536000
- finalUrl
- https://duckduckgo.com/
- requests
- 3
- timingMs
- 395
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.