Welcome - WAFDOG

Check Detail

wafdog.com · DNS

Passed Grade A

100.0%

Hostname	wafdog.com
Check name	DNS
last run	25/08/2026 10:48
Result	Incomplete Grade B 85.9%

Result Detail

DNS

Host	Type	Answer	TTL
		172.67.75.192	—
		104.26.6.216	—
		104.26.7.216	—
		2606:4700:20::681a:7d8	—
		2606:4700:20::681a:6d8	—
		2606:4700:20::ac43:4bc0	—

Result Detail

HEADER

Alerts

Strict-Transport-Security: HSTS active but consider preload
Cross-Origin-Opener-Policy: Header missing
Cross-Origin-Embedder-Policy: Header missing
Cross-Origin-Resource-Policy: Header missing
Expect-CT: Expect-CT missing
X-Permitted-Cross-Domain-Policies: Header missing
Access-Control-Allow-Origin: Access-Control-Allow-Origin missing
Server: Sensitive header exposed
Origin-Agent-Cluster: Header missing

Normalized headers

date	Tue, 25 Aug 2026 08:48:49 GMT
content-type	text/html; charset=utf-8
cache-control	no-cache, private
content-security-policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' * data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; media-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; report-uri
permissions-policy	autoplay=(self), encrypted-media=(self), fullscreen=(), geolocation=(self), gyroscope=(self), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(self), usb=()
referrer-policy	no-referrer-when-downgrade
strict-transport-security	max-age=31536000; includeSubDomains
x-content-type-options	nosniff
x-frame-options	DENY
x-xss-protection	1; mode=block
cf-cache-status	DYNAMIC
report-to	{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=b5RV%2Fo8xRJYFIsAk9djAt5umuPSk1AFk6en77W1QoJ3ACUwQ4M3GoOETh38VO%2FFhDuEm4eetXFcKSll4aQeckwYoR3RS3WxczWgMjr0fG0%2BsYlK5Witr8UT%2FrBkv"}]}
nel	{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server	cloudflare
cf-ray	a30957030ce9d28c-FRA
alt-svc	h3=":443"; ma=86400

Transport

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Strict-Transport-Security	⚠️ Warning	max-age=31536000; includeSubDomains	max-age>=15768000; includeSubDomains; preload	HSTS active but consider preload	Critical	Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Expect-CT	❌ Missing		enforce; max-age>=86400	Expect-CT missing	Medium	Expect-CT: enforce, max-age=86400, report-uri="https://report.example.com"

Content Security

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Content-Security-Policy	✅ Passed	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' * data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; media-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; report-uri	default-src 'self'; frame-ancestors 'none'	default-src 'self'; frame-ancestors 'none'	Critical	Content-Security-Policy: default-src 'self'; frame-ancestors 'none'

MIME

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Content-Type-Options	✅ Passed	nosniff	nosniff	Value matches recommendation	High	X-Content-Type-Options: nosniff

Framing

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Frame-Options	✅ Passed	DENY	DENY or SAMEORIGIN	Value accepted	High	X-Frame-Options: DENY

Privacy

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Referrer-Policy	✅ Passed	no-referrer-when-downgrade	strict-origin-when-cross-origin / same-origin	strict-origin-when-cross-origin	Medium	Referrer-Policy: strict-origin-when-cross-origin

Browser Features

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Permissions-Policy	✅ Passed	autoplay=(self), encrypted-media=(self), fullscreen=(), geolocation=(self), gyroscope=(self), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(self), usb=()	camera=(); geolocation=(); microphone=()	camera=(); geolocation=(); microphone=()	Medium	Permissions-Policy: camera=(), geolocation=(), microphone=()

Cross-Origin

Check name	Status	Expected	Detail	Severity	Recommendation
Cross-Origin-Opener-Policy	❌ Missing	same-origin	Header missing	High	Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy	❌ Missing	require-corp	Header missing	High	Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy	❌ Missing	same-origin	Header missing	Medium	Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster	❌ Missing	?1	Header missing	Low	Origin-Agent-Cluster: ?1

Caching

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Cache-Control	✅ Passed	no-cache, private	no-store, private, max-age=0	no-store, private, max-age=0	High	Cache-Control: no-store, private, max-age=0

Legacy

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Permitted-Cross-Domain-Policies	❌ Missing		none	Header missing	Low	X-Permitted-Cross-Domain-Policies: none

CORS

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Access-Control-Allow-Origin	❌ Missing		Scoped origin (no wildcard)	Access-Control-Allow-Origin missing	Medium	Access-Control-Allow-Origin: https://app.example.com

Information Disclosure

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Server	❌ Missing	cloudflare	Header removed or generic	Sensitive header exposed	High	Remove Server header or set to a generic token
X-Powered-By	✅ Passed		Header removed	Header not exposed	High	Remove X-Powered-By header
X-AspNet-Version	✅ Passed		Header removed	Header not exposed	Medium	Remove framework version headers

Raw headers

HTTP/2 200 
date: Tue, 25 Aug 2026 08:48:49 GMT
content-type: text/html; charset=utf-8
cache-control: no-cache, private
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' * data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; media-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; report-uri
permissions-policy: autoplay=(self), encrypted-media=(self), fullscreen=(), geolocation=(self), gyroscope=(self), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(self), usb=()
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=b5RV%2Fo8xRJYFIsAk9djAt5umuPSk1AFk6en77W1QoJ3ACUwQ4M3GoOETh38VO%2FFhDuEm4eetXFcKSll4aQeckwYoR3RS3WxczWgMjr0fG0%2BsYlK5Witr8UT%2FrBkv"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: a30957030ce9d28c-FRA
alt-svc: h3=":443"; ma=86400

Result Detail

SSL

Check name	Status	Value
certificate chain is complete	✅ Passed	4
root CA is trusted	✅ Passed	Trusted
cert valid for	✅ Passed	70
chain certs are valid until	✅ Passed	03.11.2026
CN matches Domainname	✅ Passed	wafdog.com
certificate subject	✅ Passed	CN=wafdog.com
certificate issuer	✅ Passed	C=US, O=Google Trust Services, CN=WE1
signature algorithm	✅ Passed	ecdsa-with-SHA256
TLS protocol	✅ Passed	TLSv1.3 TLS_AES_256_GCM_SHA384
Subject Alternative Names	✅ Passed	wafdog.com, *.wafdog.com
Public Key	✅ Passed	EC 256

Certificate chain

#	Common name	Issuer	Valid until	CA
0	wafdog.com	C=US, O=Google Trust Services, CN=WE1	03.11.2026 21:24:04	No
1	wafdog.com	C=US, O=Google Trust Services, CN=WE1	03.11.2026 21:24:04	No
2	WE1	C=US, O=Google Trust Services LLC, CN=GTS Root R4	20.02.2029 15:00:00	Yes
3	GTS Root R4	C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA	28.01.2028 01:00:42	Yes

TLS details

Negotiated protocol	TLSv1.3
Cipher suite	TLS_AES_256_GCM_SHA384 (256 bit)
Cipher version	TLSv1.3
Perfect Forward Secrecy	Attention
Earliest chain expiry	03.11.2026 21:24

Fingerprints

SHA-256	`08:8D:1E:81:F8:2D:EE:46:09:9D:DB:76:A4:A0:77:EA:93:40:67:0C:67:35:B2:56:39:93:AB:54:AC:FD:9C:C9`
SHA-1	`B5:65:EC:6F:95:42:B0:EE:AB:05:9E:EA:A8:04:5C:FE:D5:C2:A1:72`

Revocation

OCSP URLs

—

CRL URLs

Full Name: URI:http://c.pki.goog/we1/XWPkyQXvHmQ.crl

Issuer URLs (AIA)

http://i.pki.goog/we1.crt

OCSP Must-Staple No

Trust evaluation

Attempted: Yes

Trusted: Yes

OpenSSL diagnostic command

openssl s_client -connect wafdog.com:443 -servername wafdog.com

Result Detail

WAF

Ownership verification required

Real WAF results become available after signing up. Until then we show you a small teaser from the imagination department.

Shield level Mythisch
Watchers Gremlins im Standby
Last attack Story folgt nach Registrierung

Result Detail

Result Detail

Alerts

Normalized headers

Transport

Content Security

MIME

Framing

Privacy

Browser Features

Cross-Origin

Caching

Legacy

CORS

Information Disclosure

Raw headers

Result Detail

Certificate chain

TLS details

Fingerprints

Revocation

Trust evaluation

OpenSSL diagnostic command

Result Detail

Cookies & Tracking