OpenCloud Security Scanner

tlsTrusted The certificate chain is not trusted tlsProtocol An outdated TLS protocol version was negotiated tlsDeprecatedProtocol TLS 1.0 or TLS 1.1 is still accepted tlsCertificate The certificate expires soon, or has expired tlsCertificateLifetime The certificate was issued for an unusually long time tlsCipherSuite The negotiated TLS cipher suite is weak tlsCertificatePolicy The certificate uses a weak key or signature tlsAddressParity IPv4 and IPv6 do not present the same TLS service cookieSecure An observed cookie can travel over HTTP cookieHttpOnly An observed cookie is readable by page scripts cookieSameSite An observed cookie has no cross-site policy cookiePrefix An observed cookie carries no name prefix, or breaks the one it claims tlsChain The server does not send a complete certificate chain tlsOcspStapling No OCSP response is stapled to the handshake tlsCertificateTransparency The certificate carries no Certificate Transparency proof tlsEarlyData The server accepts TLS 1.3 early data corsOriginRestricted Cross-origin requests are accepted from any site traceMethodDisabled The server answers the HTTP TRACE method versionDisclosure:Server A response header publishes a software version (Server) versionDisclosure:X-Powered-By A response header publishes a software version (X-Powered-By) webfingerVersionDisclosure The webfinger document publishes the exact version directoryListing A web server is serving a directory index

basicAuthDisabled HTTP Basic authentication is enabled cspWithoutUnsafeInline The Content-Security-Policy allows inline scripts or eval publicLinkPasswordEnforced Public links can be created without a password passwordPolicyEnforced The password policy is disabled or allows short passwords passwordPolicyComplexity The password policy no longer requires mixed characters hstsLongMaxAge Strict-Transport-Security has a short max-age hstsPreload Strict-Transport-Security has no preload directive httpsEnforced Plain HTTP is not redirected to HTTPS identityProviderDetected No identity provider could be found oidcPkceSupported The identity provider does not offer PKCE with S256 oidcImplicitFlowDisabled The identity provider still offers the implicit flow oidcSigningAlgorithmStrong ID tokens may be signed with a weak or absent algorithm oidcEndpointsUseHttps The identity provider publishes an endpoint on plain HTTP reverseProxyDetected No reverse proxy could be detected in front of the instance

Strict-Transport-Security The Strict-Transport-Security header is missing or too weak Content-Security-Policy The Content-Security-Policy header is missing or too weak X-Content-Type-Options The X-Content-Type-Options header is missing or too weak X-Frame-Options The X-Frame-Options header is missing or too weak X-Permitted-Cross-Domain-Policies The X-Permitted-Cross-Domain-Policies header is missing or too weak X-Robots-Tag The X-Robots-Tag header is missing or too weak X-XSS-Protection The X-XSS-Protection header is missing or too weak Referrer-Policy The Referrer-Policy header is missing or too weak