Website check
jup.ag
In plain English
Overall, jup.ag scores well on this passive check, with an A+ grade (97/100). The findings are minor: one low-severity item and three informational notes. The most important thing to fix first is the Content Security Policy, which has no rule for scripts, so it does not block injected scripts; adding a script-src or default-src rule would close that gap. Visitors do not need to be worried based on these findings alone, since the check found no serious problems.
Content Security Policy does not limit scripts
The policy has no script-src or default-src rule, so it does nothing to stop injected scripts.
How to fix: Add a script-src (or default-src) rule that lists only the sources the site uses.
base-uri 'self' https://static.jup.ag https://static-nsc8aacry.preview.jup.ag; object-src 'none'; frame-ancestors 'self'...
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
No CAA record
CAA records limit which certificate authorities may issue certificates for jup.ag, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up jup.ag and connecting over HTTPS
- 03Connected over HTTPS: jup.ag answered 200
- 04Certificate from Google Trust Services, valid 89 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 1 cookie for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 97/100, grade A+. Writing it up in plain English
Technical details (30)
- ip
- 104.18.43.59
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- jup.ag
- tls validTo
- 2027-01-19T18:45:00.000Z
- tls daysLeft
- 89
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf.mlsend.com include:_spf.google.com -all
- email apex
- jup.ag
- email dmarc
- v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email; pct=100
- status
- 200
- cookies
- metrics.stable_id
- headers server
- cloudflare
- headers referrer-policy
- strict-origin-when-cross-origin
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- headers content-security-policy
- base-uri 'self' https://static.jup.ag https://static-nsc8aacry.preview.jup.ag; object-src 'none'; frame-ancestors 'self'; form-action 'self'
- headers strict-transport-security
- max-age=63072000
- finalUrl
- https://jup.ag/
- requests
- 3
- timingMs
- 492
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- static.cloudflareinsights.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.