Website check
instagram.com
In plain English
The site scores a B (81 out of 100). Most findings are small hardening gaps, not active problems. The most important fix is the HTTPS certificate, which this scan says expires in 7 days. Once it lapses, browsers will show visitors a security warning, so confirm it has
HTTPS certificate expires soon
The certificate expires in 7 days. After that, browsers show a security warning.
How to fix: Renew it now and make sure automatic renewal works.
valid until 2026-10-29
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: csrftoken, mid
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-eval'
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
static.cdninstagram.com
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up instagram.com and connecting over HTTPS
- 03Connected over HTTPS: www.instagram.com answered 200 after 1 redirect
- 04Certificate from DigiCert Inc, valid 7 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff set; missing Referrer-Policy
- 06Checked 2 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Plain http:// redirects to HTTPS
- 10Old TLS 1.0/1.1: refused
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 81/100, grade B. Writing it up in plain English
Technical details (28)
- ip
- 57.144.216.34
- caa
- 0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af"
- tls cipher
- TLS_CHACHA20_POLY1305_SHA256
- tls issuer
- DigiCert Inc
- tls subject
- *.www.instagram.com
- tls validTo
- 2026-10-29T23:59:59.000Z
- tls daysLeft
- 7
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:facebookmail.com include:_spf.fb.com -all
- email apex
- instagram.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; pct=100
- status
- 200
- cookies
- csrftoken, mid
- headers x-frame-options
- DENY
- headers permissions-policy
- accelerometer=(self "https://www.fbsbx.com"), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-...
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src *.facebook.com *.fbcdn.net *.instagram.com blob:;script-src *.instagram.com static.cdninstagram.com z-p42-static.cdninstagram.com https://instagram.com https://*.www.instagram.com https://*.cdninstagram.com wss://www.instagram.com blob: *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1...
- headers strict-transport-security
- max-age=31536000; preload; includeSubDomains
- finalUrl
- https://www.instagram.com/
- requests
- 5
- timingMs
- 952
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- static.cdninstagram.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.