Website check
php.net
In plain English
php.net scores B (84/100). The biggest issue: no Content Security Policy (plus 3 more).
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
DMARC is in monitor-only mode
The DMARC policy is p=none, so fake email in php.net's name is reported but still delivered.
How to fix: Once the reports look clean, change the policy to p=quarantine and then p=reject.
v=DMARC1; p=none; rua=mailto:dmarc@php.net;
No CAA record
CAA records limit which certificate authorities may issue certificates for php.net, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (12 steps)
- 01Picked up your request
- 02Looking up php.net and connecting over HTTPS
- 03Connected over HTTPS: www.php.net answered 200 after 1 redirect
- 04Certificate from Let's Encrypt, valid 88 more days (TLSv1.3)
- 05Read the security headers: HSTS, X-Frame-Options set; missing CSP, nosniff, Referrer-Policy
- 06No PHP version given away
- 07Found 0 script sources from other sites
- 08Old TLS 1.0/1.1: refused
- 09security.txt found
- 10Plain http:// redirects to HTTPS
- 11Email spoofing protection: SPF set, DMARC set
- 12Scored 84/100, grade B. Writing it up in plain English
Technical details (27)
- ip
- 2400:52e0:1::1
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Let's Encrypt
- tls subject
- www.php.net
- tls validTo
- 2027-01-18T13:08:28.000Z
- tls daysLeft
- 88
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:140.211.15.143 ip4:45.112.84.5 ip4:142.93.197.176 ip6:2604:a880:400:d0::1c74:1001 ip6:2a02:cb43:8000::1102 ip4:157.90.121.187 ip6:2a01:4f8:1c1e:416d::1 ~all
- email apex
- php.net
- email dmarc
- v=DMARC1; p=none; rua=mailto:dmarc@php.net;
- status
- 200
- cookies
- headers server
- BunnyCDN-MEL1-1140
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- interest-cohort=()
- headers strict-transport-security
- max-age=15768000
- finalUrl
- https://www.php.net/
- requests
- 4
- timingMs
- 2889
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.