Website check
joomla.org
In plain English
The site scores A (87 out of 100), and this passive check found no serious problems. The most important fix is to turn off the old TLS 1.1 setting, and the owner should confirm the server runs a current PHP version with the patch for the PHP2Shell flaw, since the check could not see which version is in use. Visitors do not need to worry; these findings are about tightening settings, not signs that the site can be broken into today.
Old TLS versions still accepted
The server still accepts TLS 1.1, outdated encryption that browsers dropped in 2020 and that weakens protection for older devices.
How to fix: Turn off TLS 1.0 and 1.1 in the server or CDN settings and keep TLS 1.2 and 1.3.
TLSv1.1 with ECDHE-RSA-AES128-SHA
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: 312b0a5d22b922fb76560c8879ef7cd8
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-inline'
Runs PHP (version hidden)
The site appears to run on PHP but does not say which version. A critical PHP flaw, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), was patched on 21 October 2026.
How to fix: Confirm your server or host has applied the 21 October 2026 PHP security release (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later).
Joomla detected
No CAA record
CAA records limit which certificate authorities may issue certificates for joomla.org, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (14 steps)
- 01Picked up a daily rating check
- 02Looking up joomla.org and connecting over HTTPS
- 03Connected over HTTPS: www.joomla.org answered 200 after 1 redirect
- 04Certificate from Google Trust Services, valid 88 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
- 06Checked 1 cookie for Secure, HttpOnly and SameSite
- 07Runs PHP (Joomla detected) but hides the version, so PHP2Shell can't be ruled out from outside
- 08Platform: Joomla
- 09Found 1 script source from other sites
- 10Plain http:// redirects to HTTPS
- 11Old TLS 1.0/1.1: still accepted
- 12security.txt found
- 13Email spoofing protection: SPF set, DMARC set
- 14Scored 87/100, grade A. Writing it up in plain English
Technical details (33)
- ip
- 104.26.14.15
- caa
- php hints
- Joomla detected
- php php2shell
- unknown
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- joomla.org
- tls validTo
- 2027-01-18T12:14:17.000Z
- tls daysLeft
- 88
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 mx ip4:206.123.104.161 include:_spf.joomla.org include:_spf.google.com include:_spf.elasticemail.com ~all
- email apex
- joomla.org
- email dmarc
- v=DMARC1; p=quarantine; rua=mailto:joomla-t@dmarc.report-uri.com;
- status
- 200
- cookies
- 312b0a5d22b922fb76560c8879ef7cd8
- headers server
- cloudflare
- headers referrer-policy
- no-referrer-when-downgrade
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- interest-cohort=()
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'self'; script-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com https://*.google-analytics.com https://*.googletagmanager.com https://*.googleapis.com https://*.gstatic.com https://*.google.com https://*.joomla.org https://*.pingdom.net https://*.googleapis.com http...
- headers strict-transport-security
- max-age=31536000; includeSubDomains
- finalUrl
- https://www.joomla.org/
- platform
- Joomla
- requests
- 4
- timingMs
- 982
- reachable
- true
- oldTlsProbe
- accepted
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- static.cloudflareinsights.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.