Website check
linkedin.com
In plain English
Linkedin.com scored an A (87 out of 100) on this passive check. The most important item is the medium finding: some login-related cookies can be read by scripts, so the site should set the HttpOnly flag on those cookies first. The other findings are smaller hygiene items, and there is no reason for visitors to be alarmed, though it is worth noting that this check only looked at the site from the outside and cannot confirm how the cookies are used in practice.
Session cookies readable by scripts
Cookies that look like logins lack HttpOnly, so an injected script could steal them and take over accounts.
How to fix: Add HttpOnly to session and login cookies.
Cookies: JSESSIONID
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: sdui_ver
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: sdui_ver
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up linkedin.com and connecting over HTTPS
- 03Connected over HTTPS: www.linkedin.com answered 200 after 1 redirect
- 04Certificate from DigiCert Inc, valid 146 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 7 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Old TLS 1.0/1.1: refused
- 10security.txt found
- 11Plain http:// redirects to HTTPS
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 87/100, grade A. Writing it up in plain English
Technical details (29)
- ip
- 172.64.146.215
- caa
- 0 other "", 0 other ""
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- DigiCert Inc
- tls subject
- www.linkedin.com
- tls validTo
- 2027-03-17T23:59:59.000Z
- tls daysLeft
- 146
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:199.101.162.0/25 ip4:108.174.3.0/24 ip4:108.174.6.0/24 ip4:108.174.0.0/24 ip6:2620:109:c00d:104::/64 ip6:2620:109:c006:104::/64 ip6:2620:109:c003:104::/64 ip6:2620:119:50c0:207::/64 ip4:199.101.161.130 mx mx:docusign.net ~all
- email apex
- linkedin.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:d@rua.agari.com,mailto:yfy3q-9359@rua.dmarc.emailanalyst.com; ruf=mailto:d@ruf.agari.com
- status
- 200
- cookies
- sdui_ver, JSESSIONID, lang, bcookie, bscookie, lidc, __cf_bm
- headers server
- cloudflare
- headers referrer-policy
- strict-origin-when-cross-origin
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'none';connect-src 'self' *.licdn.com *.linkedin.com cdn.linkedin.oribi.io dpm.demdex.net/id lnkd.demdex.net blob: data: accounts.google.com/gsi/ www.google.com/recaptcha/ linkedin.sc.omtrdc.net/b/ss/ *.microsoft.com login.microsoftonline.com *.adnxs.com *.qualtrics.com *.xlgmedia.com co...
- headers strict-transport-security
- max-age=31536000
- finalUrl
- https://www.linkedin.com/
- requests
- 4
- timingMs
- 555
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- static.licdn.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.