Website check
netflix.com
In plain English
netflix.com scores B (74/100). The biggest issue: old TLS versions still accepted (plus 5 more).
Old TLS versions still accepted
The server still accepts TLS 1.1, outdated encryption that browsers dropped in 2020 and that weakens protection for older devices.
How to fix: Turn off TLS 1.0 and 1.1 in the server or CDN settings and keep TLS 1.2 and 1.3.
TLSv1.1 with ECDHE-RSA-AES128-SHA
No Content Security Policy
The site only has a report-only policy, which watches for injected scripts but does not block them.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
report-only: default-src https: wss: 'unsafe-inline' 'unsafe-eval'; font-src https: data: ; img-src https: data:...
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: flwssn, nfvdid
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: flwssn, nfvdid
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
help.nflxext.com
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up netflix.com and connecting over HTTPS
- 03Connected over HTTPS: www.netflix.com answered 200 after 2 redirects
- 04Certificate from DigiCert Inc, valid 119 more days (TLSv1.3)
- 05Read the security headers: HSTS, X-Frame-Options, nosniff set; missing CSP, Referrer-Policy
- 06Checked 5 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Old TLS 1.0/1.1: still accepted
- 10Plain http:// redirects to HTTPS
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 74/100, grade B. Writing it up in plain English
Technical details (28)
- ip
- 2a00:86c0:2042::1
- caa
- 0 issue "digicert.com", 0 issue "pki.goog", 0 issue "letsencrypt.org"
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- DigiCert Inc
- tls subject
- www.netflix.com
- tls validTo
- 2027-02-18T21:41:48.000Z
- tls daysLeft
- 119
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf_ipv4.netflix.com include:_spf.google.com include:amazonses.com include:servers.mcsv.net include:_spf.salesforce.com include:_spf.createsend.com -all
- email apex
- netflix.com
- email dmarc
- v=DMARC1; p=reject; fo=1; rua=mailto:netflix@rua.netcraft.com,mailto:dmarcreports@netflix.com,mailto:dmarc_agg@dmarc.250ok.net;ruf=mailto:netflix@ruf.netcraft.com,mailto:dmarcreports@netflix.com,mailto:dmarc_fr@dmarc.250ok.net
- status
- 200
- cookies
- flwssn, nfvdid, SecureNetflixId, NetflixId, gsid
- headers server
- envoy
- headers x-frame-options
- DENY
- headers x-content-type-options
- nosniff
- headers strict-transport-security
- max-age=31536000; includeSubDomains
- finalUrl
- https://www.netflix.com/au/
- requests
- 5
- timingMs
- 3416
- reachable
- true
- oldTlsProbe
- accepted
- securityTxt
- true
- httpRedirect
- redirects to https
- bodyTruncated
- true
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- help.nflxext.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.