Website check
perplexity.ai
In plain English
Overall, this passive check gave perplexity.ai a grade of A+ (97/100), with one low-severity finding. The main item to address is the Content Security Policy, which allows inline or eval'd scripts. That weakens one of the browser protections against injected code, so tightening it is the first thing to do. Visitors do not need to be worried based on these results alone, since the only issue found is rated low.
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-eval'
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up perplexity.ai and connecting over HTTPS
- 03Connected over HTTPS: www.perplexity.ai answered 403 after 1 redirect
- 04Certificate from Let's Encrypt, valid 81 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 1 cookie for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 97/100, grade A+. Writing it up in plain English
Technical details (30)
- ip
- 104.18.27.48
- caa
- 0 issue "ssl.com", 0 issuewild "amazon.com", 0 issuewild "comodoca.com", 0 issuewild "digicert.com; cansignhttpexchanges=yes", 0 issuewild "godaddy.com", 0 issuewild "letsencrypt.org", 0 issuewild "pki.goog; cansignhttpexchanges=yes", 0 issuewild "sectigo.com", 0 issuewild "ssl.com", 0 iodef "mailto...
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Let's Encrypt
- tls subject
- perplexity.ai
- tls validTo
- 2027-01-11T14:20:34.000Z
- tls daysLeft
- 81
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:192.174.84.143 include:_spf.google.com include:mailgun.org include:sendgrid.net ~all
- email apex
- perplexity.ai
- email dmarc
- v=DMARC1;p=reject;rua=mailto:1mc4tgph@ag.us.dmarcian.com, mailto:fbfd91c994e04da79e26e045e40c3204@dmarc-reports.cloudflare.net,mailto:dmarc@perplexity.ai,mailto:06d199fb77@rua.easydmarc.us;ruf=mailto:06d199fb77@ruf.easydmarc.us;fo=1;
- status
- 403
- cookies
- __cf_bm
- headers server
- cloudflare
- headers referrer-policy
- same-origin
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s...
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'none'; script-src 'nonce-F58TWR5oiDNTEo4TBjOLRe' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge...
- headers strict-transport-security
- max-age=31536000; includeSubDomains; preload
- finalUrl
- https://www.perplexity.ai/
- requests
- 4
- timingMs
- 114
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.