Check Detail
microsoftonline-p.com · DNS
Incomplete
Grade F
0.0%
Result Detail
DNS| Host | Type | Answer | TTL |
|---|---|---|---|
| No DNS answers captured. | |||
Result Detail
HEADERAlerts
- Strict-Transport-Security: Strict-Transport-Security missing
- Content-Security-Policy: Content-Security-Policy missing
- X-Content-Type-Options: Header missing
- X-Frame-Options: Header missing
- Referrer-Policy: Header missing
- Permissions-Policy: Permissions-Policy missing
- Cross-Origin-Opener-Policy: Header missing
- Cross-Origin-Embedder-Policy: Header missing
- Cross-Origin-Resource-Policy: Header missing
- Cache-Control: Cache-Control missing restrictive directives
- Expect-CT: Expect-CT missing
- X-Permitted-Cross-Domain-Policies: Header missing
- Access-Control-Allow-Origin: Access-Control-Allow-Origin missing
- Origin-Agent-Cluster: Header missing
Normalized headers
| default header check have error | Failed to retrieve headers. |
|---|
Transport
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Strict-Transport-Security | ❌ Missing | max-age>=15768000; includeSubDomains; preload | Strict-Transport-Security missing | Critical | Strict-Transport-Security: max-age=63072000; includeSubDomains; preload | |
| Expect-CT | ❌ Missing | enforce; max-age>=86400 | Expect-CT missing | Medium | Expect-CT: enforce, max-age=86400, report-uri="https://report.example.com" |
Content Security
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Content-Security-Policy | ❌ Missing | default-src 'self'; frame-ancestors 'none' | Content-Security-Policy missing | Critical | Content-Security-Policy: default-src 'self'; frame-ancestors 'none' |
MIME
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| X-Content-Type-Options | ❌ Missing | nosniff | Header missing | High | X-Content-Type-Options: nosniff |
Framing
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| X-Frame-Options | ❌ Missing | DENY or SAMEORIGIN | Header missing | High | X-Frame-Options: DENY |
Privacy
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Referrer-Policy | ❌ Missing | strict-origin-when-cross-origin / same-origin | Header missing | Medium | Referrer-Policy: strict-origin-when-cross-origin |
Browser Features
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Permissions-Policy | ❌ Missing | camera=(); geolocation=(); microphone=() | Permissions-Policy missing | Medium | Permissions-Policy: camera=(), geolocation=(), microphone=() |
Cross-Origin
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Cross-Origin-Opener-Policy | ❌ Missing | same-origin | Header missing | High | Cross-Origin-Opener-Policy: same-origin | |
| Cross-Origin-Embedder-Policy | ❌ Missing | require-corp | Header missing | High | Cross-Origin-Embedder-Policy: require-corp | |
| Cross-Origin-Resource-Policy | ❌ Missing | same-origin | Header missing | Medium | Cross-Origin-Resource-Policy: same-origin | |
| Origin-Agent-Cluster | ❌ Missing | ?1 | Header missing | Low | Origin-Agent-Cluster: ?1 |
Caching
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Cache-Control | ❌ Missing | no-store, private, max-age=0 | Cache-Control missing restrictive directives | High | Cache-Control: no-store, private, max-age=0 |
Legacy
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| X-Permitted-Cross-Domain-Policies | ❌ Missing | none | Header missing | Low | X-Permitted-Cross-Domain-Policies: none |
CORS
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Access-Control-Allow-Origin | ❌ Missing | Scoped origin (no wildcard) | Access-Control-Allow-Origin missing | Medium | Access-Control-Allow-Origin: https://app.example.com |
Information Disclosure
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Server | ✅ Passed | Header removed or generic | Header not exposed | High | Remove Server header or set to a generic token | |
| X-Powered-By | ✅ Passed | Header removed | Header not exposed | High | Remove X-Powered-By header | |
| X-AspNet-Version | ✅ Passed | Header removed | Header not exposed | Medium | Remove framework version headers |
Raw headers
Default Header check have error: Failed to retrieve headers.
Result Detail
SSL| Check name | Status | Value |
|---|---|---|
| certificate chain is complete | ❌ Missing | 0 |
| root CA is trusted | ❌ Missing | |
| cert valid for | ❌ Missing | 0 |
| chain certs are valid until | ❌ Missing | |
| CN matches Domainname | ❌ Missing | |
| certificate subject | ❌ Missing | |
| certificate issuer | ❌ Missing | |
| signature algorithm | ❌ Missing | |
| TLS protocol | ❌ Missing | |
| Subject Alternative Names | ❌ Missing | |
| Public Key | ❌ Missing |
TLS details
| Negotiated protocol | Not available |
|---|---|
| Cipher suite | Not available |
| Cipher version | Not available |
| Perfect Forward Secrecy | Attention |
Fingerprints
| SHA-256 | — |
|---|---|
| SHA-1 | — |
Revocation
OCSP URLs
—
CRL URLs
—
Issuer URLs (AIA)
—
OCSP Must-Staple
No
Trust evaluation
Attempted: Yes
Trusted: No
php_network_getaddresses: getaddrinfo for microsoftonline-p.com failed: No address associated with hostname
OpenSSL diagnostic command
openssl s_client -connect microsoftonline-p.com:443 -servername microsoftonline-p.com
Result Detail
WAFSign up to use!
Ownership verification required
Real WAF results become available after signing up. Until then we show you a small teaser from the imagination department.
- Shield level Mythisch
- Watchers Gremlins im Standby
- Last attack Story folgt nach Registrierung