Website check
notion.so
In plain English
Overall, this passive check gave notion.so a grade of A (85/100). The findings are mostly low severity and relate to header and cookie settings, not an active break-in. The most important thing to fix first is the cookie settings: make sure session cookies carry the Secure and SameSite flags so they are only sent over HTTPS and not on cross-site requests. Visitors do not need to panic, but as a precaution they should keep using the official site over HTTPS and be wary of unexpected login prompts.
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: notion_browser_id, notion_check_cookie_consent
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: notion_browser_id, notion_check_cookie_consent
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-inline' 'unsafe-eval'
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
X-Powered-By header reveals the platform
The header advertises what the site runs on, which helps attackers pick their tools.
How to fix: Remove the X-Powered-By header (for PHP, set expose_php = Off).
X-Powered-By: Next.js
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
No CAA record
CAA records limit which certificate authorities may issue certificates for notion.so, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up notion.so and connecting over HTTPS
- 03Connected over HTTPS: www.notion.com answered 200 after 2 redirects
- 04Certificate from Google Trust Services, valid 48 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, Referrer-Policy set; missing X-Frame-Options, nosniff
- 06Checked 3 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11No security.txt
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 85/100, grade A. Writing it up in plain English
Technical details (28)
- ip
- 208.103.161.2
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- notion.com
- tls validTo
- 2026-12-10T04:12:45.000Z
- tls daysLeft
- 48
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ~all
- email apex
- notion.so
- email dmarc
- v=DMARC1; p=quarantine; pct=100; rua=mailto:re+1b3a27dd30bc@inbound.dmarcdigests.com;
- status
- 200
- cookies
- notion_browser_id, notion_check_cookie_consent, __cf_bm
- headers server
- cloudflare
- headers x-powered-by
- Next.js
- headers referrer-policy
- strict-origin-when-cross-origin
- headers content-security-policy
- script-src 'self' 'unsafe-inline' 'unsafe-eval' https://gist.github.com https://apis.google.com https://cdn.amplitude.com https://api.amplitude.com https://dev-embed.notion.co https://embed.notion.co https://static.zdassets.com https://api.smooch.io https://solve-widget.forethought.ai https://decag...
- headers strict-transport-security
- max-age=31536000; includeSubDomains; preload
- finalUrl
- https://www.notion.com/
- requests
- 5
- timingMs
- 347
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.