Welcome - WAFDOG

Check Detail

wafdog.com · DNS

Passed Grade A

100.0%

Hostname	wafdog.com
Check name	DNS
last run	14/01/2026 08:23
Result	Incomplete Grade B 85.9%

Result Detail

DNS

Host	Type	Answer	TTL
		172.67.75.192	—
		104.26.6.216	—
		104.26.7.216	—
		2606:4700:20::ac43:4bc0	—
		2606:4700:20::681a:6d8	—
		2606:4700:20::681a:7d8	—

Result Detail

HEADER

Alerts

Strict-Transport-Security: HSTS active but consider preload
Cross-Origin-Opener-Policy: Header missing
Cross-Origin-Embedder-Policy: Header missing
Cross-Origin-Resource-Policy: Header missing
Expect-CT: Expect-CT missing
X-Permitted-Cross-Domain-Policies: Header missing
Access-Control-Allow-Origin: Access-Control-Allow-Origin missing
Server: Sensitive header exposed
Origin-Agent-Cluster: Header missing

Normalized headers

date	Wed, 14 Jan 2026 07:23:06 GMT
content-type	text/html; charset=UTF-8
cache-control	no-cache, private
content-security-policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' * data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; media-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; report-uri
permissions-policy	autoplay=(self), encrypted-media=(self), fullscreen=(), geolocation=(self), gyroscope=(self), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(self), usb=()
referrer-policy	no-referrer-when-downgrade
server	cloudflare
strict-transport-security	max-age=31536000; includeSubDomains
x-content-type-options	nosniff
x-frame-options	DENY
x-xss-protection	1; mode=block
cf-cache-status	DYNAMIC
report-to	{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BBBMsldCsKeGUmq9kvnRL465gamdmGbFvNedNciFaNytziFUq8P5nwQemVClFcodgztU%2FJ58mgEHpMD73QUxrnOPPeApKSbNfdA%3D"}]}
nel	{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray	9bdb62d05e7577d1-FRA
alt-svc	h3=":443"; ma=86400

Transport

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Strict-Transport-Security	⚠️ Warning	max-age=31536000; includeSubDomains	max-age>=15768000; includeSubDomains; preload	HSTS active but consider preload	Critical	Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Expect-CT	❌ Missing		enforce; max-age>=86400	Expect-CT missing	Medium	Expect-CT: enforce, max-age=86400, report-uri="https://report.example.com"

Content Security

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Content-Security-Policy	✅ Passed	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' * data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; media-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; report-uri	default-src 'self'; frame-ancestors 'none'	default-src 'self'; frame-ancestors 'none'	Critical	Content-Security-Policy: default-src 'self'; frame-ancestors 'none'

MIME

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Content-Type-Options	✅ Passed	nosniff	nosniff	Value matches recommendation	High	X-Content-Type-Options: nosniff

Framing

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Frame-Options	✅ Passed	DENY	DENY or SAMEORIGIN	Value accepted	High	X-Frame-Options: DENY

Privacy

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Referrer-Policy	✅ Passed	no-referrer-when-downgrade	strict-origin-when-cross-origin / same-origin	strict-origin-when-cross-origin	Medium	Referrer-Policy: strict-origin-when-cross-origin

Browser Features

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Permissions-Policy	✅ Passed	autoplay=(self), encrypted-media=(self), fullscreen=(), geolocation=(self), gyroscope=(self), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(self), usb=()	camera=(); geolocation=(); microphone=()	camera=(); geolocation=(); microphone=()	Medium	Permissions-Policy: camera=(), geolocation=(), microphone=()

Cross-Origin

Check name	Status	Expected	Detail	Severity	Recommendation
Cross-Origin-Opener-Policy	❌ Missing	same-origin	Header missing	High	Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy	❌ Missing	require-corp	Header missing	High	Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy	❌ Missing	same-origin	Header missing	Medium	Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster	❌ Missing	?1	Header missing	Low	Origin-Agent-Cluster: ?1

Caching

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Cache-Control	✅ Passed	no-cache, private	no-store, private, max-age=0	no-store, private, max-age=0	High	Cache-Control: no-store, private, max-age=0

Legacy

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Permitted-Cross-Domain-Policies	❌ Missing		none	Header missing	Low	X-Permitted-Cross-Domain-Policies: none

CORS

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Access-Control-Allow-Origin	❌ Missing		Scoped origin (no wildcard)	Access-Control-Allow-Origin missing	Medium	Access-Control-Allow-Origin: https://app.example.com

Information Disclosure

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Server	❌ Missing	cloudflare	Header removed or generic	Sensitive header exposed	High	Remove Server header or set to a generic token
X-Powered-By	✅ Passed		Header removed	Header not exposed	High	Remove X-Powered-By header
X-AspNet-Version	✅ Passed		Header removed	Header not exposed	Medium	Remove framework version headers

Raw headers

HTTP/2 200 
date: Wed, 14 Jan 2026 07:23:06 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' * data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; media-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; report-uri
permissions-policy: autoplay=(self), encrypted-media=(self), fullscreen=(), geolocation=(self), gyroscope=(self), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(self), usb=()
referrer-policy: no-referrer-when-downgrade
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BBBMsldCsKeGUmq9kvnRL465gamdmGbFvNedNciFaNytziFUq8P5nwQemVClFcodgztU%2FJ58mgEHpMD73QUxrnOPPeApKSbNfdA%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9bdb62d05e7577d1-FRA
alt-svc: h3=":443"; ma=86400

Result Detail

SSL

Check name	Status	Value
certificate chain is complete	✅ Passed	4
root CA is trusted	✅ Passed	Trusted
cert valid for	✅ Passed	57
chain certs are valid until	✅ Passed	12.03.2026
CN matches Domainname	✅ Passed	wafdog.com
certificate subject	✅ Passed	CN=wafdog.com
certificate issuer	✅ Passed	C=US, O=Google Trust Services, CN=WE1
signature algorithm	✅ Passed	ecdsa-with-SHA256
TLS protocol	✅ Passed	TLSv1.3 TLS_AES_256_GCM_SHA384
Subject Alternative Names	✅ Passed	wafdog.com, *.wafdog.com
Public Key	✅ Passed	EC 256

Certificate chain

#	Common name	Issuer	Valid until	CA
0	wafdog.com	C=US, O=Google Trust Services, CN=WE1	12.03.2026 04:43:27	No
1	wafdog.com	C=US, O=Google Trust Services, CN=WE1	12.03.2026 04:43:27	No
2	WE1	C=US, O=Google Trust Services LLC, CN=GTS Root R4	20.02.2029 15:00:00	Yes
3	GTS Root R4	C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA	28.01.2028 01:00:42	Yes

TLS details

Negotiated protocol	TLSv1.3
Cipher suite	TLS_AES_256_GCM_SHA384 (256 bit)
Cipher version	TLSv1.3
Perfect Forward Secrecy	Attention
Earliest chain expiry	12.03.2026 04:43

Fingerprints

SHA-256	`58:76:17:AC:76:C8:9B:EC:17:F4:64:2B:CC:E1:15:56:12:20:D5:00:9C:B8:16:C9:E8:07:80:2A:F3:FC:E9:68`
SHA-1	`88:78:BD:5F:54:19:3D:23:AF:35:4F:EC:80:41:4B:B0:B6:79:E3:8D`

Revocation

OCSP URLs

http://o.pki.goog/s/we1/nBU

CRL URLs

Full Name: URI:http://c.pki.goog/we1/H9bdJBu1Tvg.crl

Issuer URLs (AIA)

http://i.pki.goog/we1.crt

OCSP Must-Staple No

Trust evaluation

Attempted: Yes

Trusted: Yes

OpenSSL diagnostic command

openssl s_client -connect wafdog.com:443 -servername wafdog.com

Result Detail

WAF

Ownership verification required

Real WAF results become available after signing up. Until then we show you a small teaser from the imagination department.

Shield level Mythisch
Watchers Gremlins im Standby
Last attack Story folgt nach Registrierung

Result Detail

Result Detail

Alerts

Normalized headers

Transport

Content Security

MIME

Framing

Privacy

Browser Features

Cross-Origin

Caching

Legacy

CORS

Information Disclosure

Raw headers

Result Detail

Certificate chain

TLS details

Fingerprints

Revocation

Trust evaluation

OpenSSL diagnostic command

Result Detail

Cookies & Tracking