Website check
spotify.com
In plain English
This is a passive check of spotify.com. It scored an A (88/100), and it found seven minor items, none rated higher than low. The most useful first step for the site owner is to tighten the Content Security Policy by removing the allowance for unsafe inline and eval'd scripts, and to add integrity checks to third-party scripts where the provider supports them. Visitors do not need to be worried. The findings are hardening gaps, not evidence that anyone is being attacked or that visitor data is currently at risk.
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: sp_t, sp_new, sp_landing
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-eval'
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
open.spotifycdn.com
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
No CAA record
CAA records limit which certificate authorities may issue certificates for spotify.com, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up spotify.com and connecting over HTTPS
- 03Connected over HTTPS: open.spotify.com answered 200 after 2 redirects
- 04Certificate from Certainly, valid 25 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, nosniff set; missing X-Frame-Options, Referrer-Policy
- 06Checked 5 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Old TLS 1.0/1.1: refused
- 10No security.txt
- 11Plain http:// redirects to HTTPS
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 88/100, grade A. Writing it up in plain English
Technical details (27)
- ip
- 146.75.43.42
- caa
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- Certainly
- tls subject
- open.spotify.com
- tls validTo
- 2026-11-16T17:11:54.000Z
- tls daysLeft
- 25
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:80.76.146.172 ip4:80.76.146.173 include:_spf.google.com include:servers.mcsv.net include:_spf.salesforce.com include:_spf.netigate.se include:21894833.spf06.hubspotemail.net ~all
- email apex
- spotify.com
- email dmarc
- v=DMARC1; p=reject; sp=reject; pct=100; fo=1; rf=afrf; rua=mailto:6jxge2ly@ag.eu.dmarcian.com;
- status
- 200
- cookies
- sp_t, sp_landing, sp_t, sp_new, sp_landing
- headers server
- envoy
- headers x-content-type-options
- nosniff
- headers content-security-policy
- script-src 'self' 'unsafe-eval' blob: open.spotifycdn.com open-review.spotifycdn.com quicksilver.scdn.co www.google-analytics.com www.googletagmanager.com static.ads-twitter.com analytics.twitter.com s.pinimg.com sc-static.net https://www.google.com/recaptcha/ cdn.ravenjs.com connect.facebook.net ww...
- headers strict-transport-security
- max-age=31536000
- finalUrl
- https://open.spotify.com/
- requests
- 5
- timingMs
- 853
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- open.spotifycdn.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.