Website check
vercel.com
In plain English
Vercel's website scored an A (94 out of 100) on this passive check, which is a strong result. The most important item to fix first is the Content Security Policy, which allows inline and eval'd scripts and so weakens protection against injected code. Visitors do not need to be worried. The other two items are minor: the X-Powered-By header reveals the platform, and the site has no Permissions-Policy header to switch off features like the camera, microphone and location.
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-eval' 'unsafe-inline'
X-Powered-By header reveals the platform
The header advertises what the site runs on, which helps attackers pick their tools.
How to fix: Remove the X-Powered-By header (for PHP, set expose_php = Off).
X-Powered-By: Next.js, Payload
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up vercel.com and connecting over HTTPS
- 03Connected over HTTPS: vercel.com answered 200
- 04Certificate from Let's Encrypt, valid 63 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 3 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: refused
- 10Plain http:// redirects to HTTPS
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 94/100, grade A. Writing it up in plain English
Technical details (31)
- ip
- 64.239.109.65
- caa
- 0 issue "pki.goog", 0 issue "letsencrypt.org", 0 issue "globalsign.com", 0 issue "sectigo.com"
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- Let's Encrypt
- tls subject
- *.vercel.com
- tls validTo
- 2026-12-24T12:18:21.000Z
- tls daysLeft
- 63
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com include:mktomail.com include:amazonses.com include:sendgrid.net include:_spf.salesforce.com include:spf.mtasv.net ~all
- email apex
- vercel.com
- email dmarc
- v=DMARC1; p=quarantine; rua=mailto:df9481016e14030@rep.dmarcanalyzer.com; ruf=mailto:df9481016e14030@for.dmarcanalyzer.com; pct=100; fo=1;
- status
- 200
- cookies
- _v-consent, _v-visitor-id, _v-visitor-id-renewed
- headers server
- Vercel
- headers x-powered-by
- Next.js, Payload
- headers referrer-policy
- origin-when-cross-origin
- headers x-frame-options
- DENY
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'self' vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/*;script-src 'self' 'unsafe-eval' 'unsafe-inline' 'inlin...
- headers strict-transport-security
- max-age=31536000; includeSubDomains; preload
- finalUrl
- https://vercel.com/
- requests
- 3
- timingMs
- 276
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.