Welcome - WAFDOG

Check Detail

google.com · HEADER

Incomplete Grade F

30.8%

Hostname	google.com
Check name	HEADER
last run	11/11/2025 07:54
Result	Incomplete Grade B 76.9%

Result Detail

HEADER

Alerts

Strict-Transport-Security: Strict-Transport-Security missing
Content-Security-Policy: Content-Security-Policy missing
X-Content-Type-Options: Header missing
Referrer-Policy: Header missing
Cross-Origin-Opener-Policy: Unexpected value
Cross-Origin-Embedder-Policy: Header missing
Cross-Origin-Resource-Policy: Header missing
Expect-CT: Expect-CT missing
X-Permitted-Cross-Domain-Policies: Header missing
Access-Control-Allow-Origin: Access-Control-Allow-Origin missing
Server: Sensitive header exposed
Origin-Agent-Cluster: Header missing

Normalized headers

location	https://www.google.com/
content-type	text/html; charset=UTF-8
content-security-policy-report-only	object-src 'none';base-uri 'self';script-src 'nonce-dFIf1xyBIO_AugYNHswsUA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
cross-origin-opener-policy	same-origin-allow-popups; report-to="gws"
report-to	{"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy	unload=()
date	Tue, 11 Nov 2025 06:54:19 GMT
expires	Thu, 11 Dec 2025 06:54:19 GMT
cache-control	public, max-age=2592000
server	gws
content-length	220
x-xss-protection	0
x-frame-options	SAMEORIGIN
alt-svc	h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Transport

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Strict-Transport-Security	❌ Missing		max-age>=15768000; includeSubDomains; preload	Strict-Transport-Security missing	Critical	Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Expect-CT	❌ Missing		enforce; max-age>=86400	Expect-CT missing	Medium	Expect-CT: enforce, max-age=86400, report-uri="https://report.example.com"

Content Security

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Content-Security-Policy	❌ Missing		default-src 'self'; frame-ancestors 'none'	Content-Security-Policy missing	Critical	Content-Security-Policy: default-src 'self'; frame-ancestors 'none'

MIME

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Content-Type-Options	❌ Missing		nosniff	Header missing	High	X-Content-Type-Options: nosniff

Framing

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Frame-Options	✅ Passed	SAMEORIGIN	DENY or SAMEORIGIN	Value accepted	High	X-Frame-Options: DENY

Privacy

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Referrer-Policy	❌ Missing		strict-origin-when-cross-origin / same-origin	Header missing	Medium	Referrer-Policy: strict-origin-when-cross-origin

Browser Features

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Permissions-Policy	✅ Passed	unload=()	camera=(); geolocation=(); microphone=()	camera=(); geolocation=(); microphone=()	Medium	Permissions-Policy: camera=(), geolocation=(), microphone=()

Cross-Origin

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Cross-Origin-Opener-Policy	❌ Missing	same-origin-allow-popups; report-to="gws"	same-origin	Unexpected value	High	Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy	❌ Missing		require-corp	Header missing	High	Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy	❌ Missing		same-origin	Header missing	Medium	Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster	❌ Missing		?1	Header missing	Low	Origin-Agent-Cluster: ?1

Caching

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Cache-Control	✅ Passed	public, max-age=2592000	no-store, private, max-age=0	no-store, private, max-age=0	High	Cache-Control: no-store, private, max-age=0

Legacy

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Permitted-Cross-Domain-Policies	❌ Missing		none	Header missing	Low	X-Permitted-Cross-Domain-Policies: none

CORS

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Access-Control-Allow-Origin	❌ Missing		Scoped origin (no wildcard)	Access-Control-Allow-Origin missing	Medium	Access-Control-Allow-Origin: https://app.example.com

Information Disclosure

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Server	❌ Missing	gws	Header removed or generic	Sensitive header exposed	High	Remove Server header or set to a generic token
X-Powered-By	✅ Passed		Header removed	Header not exposed	High	Remove X-Powered-By header
X-AspNet-Version	✅ Passed		Header removed	Header not exposed	Medium	Remove framework version headers

Raw headers

HTTP/2 301 
location: https://www.google.com/
content-type: text/html; charset=UTF-8
content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-dFIf1xyBIO_AugYNHswsUA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
date: Tue, 11 Nov 2025 06:54:19 GMT
expires: Thu, 11 Dec 2025 06:54:19 GMT
cache-control: public, max-age=2592000
server: gws
content-length: 220
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000