Welcome - WAFDOG

Check Detail

barracuda.com · HEADER

Incomplete Grade F

26.9%

Hostname	barracuda.com
Check name	HEADER
last run	31/01/2026 21:30
Result	Incomplete Grade B 75.6%

Result Detail

HEADER

Alerts

Strict-Transport-Security: Strict-Transport-Security missing
Content-Security-Policy: Content-Security-Policy missing
X-Frame-Options: Header missing
Referrer-Policy: Header missing
Permissions-Policy: Permissions-Policy missing
Cross-Origin-Opener-Policy: Header missing
Cross-Origin-Embedder-Policy: Header missing
Cross-Origin-Resource-Policy: Header missing
Expect-CT: Expect-CT missing
X-Permitted-Cross-Domain-Policies: Header missing
Access-Control-Allow-Origin: Access-Control-Allow-Origin missing
Server: Sensitive header exposed
Origin-Agent-Cluster: Header missing

Normalized headers

date	Sat, 31 Jan 2026 20:30:39 GMT
content-type	text/html
content-length	155
location	https://www.barracuda.com/
er-request-id	1a380cfa042dfc270d4de149e698cd0f
pragma	no-cache
cache-control	no-store, max-age=0
x-content-type-options	nosniff
er-rule-id	r-34a4535e-2fc6-4d0d-b459-c89d41886e30
server	EasyRedir

Transport

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Strict-Transport-Security	❌ Missing		max-age>=15768000; includeSubDomains; preload	Strict-Transport-Security missing	Critical	Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Expect-CT	❌ Missing		enforce; max-age>=86400	Expect-CT missing	Medium	Expect-CT: enforce, max-age=86400, report-uri="https://report.example.com"

Content Security

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Content-Security-Policy	❌ Missing		default-src 'self'; frame-ancestors 'none'	Content-Security-Policy missing	Critical	Content-Security-Policy: default-src 'self'; frame-ancestors 'none'

MIME

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Content-Type-Options	✅ Passed	nosniff	nosniff	Value matches recommendation	High	X-Content-Type-Options: nosniff

Framing

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Frame-Options	❌ Missing		DENY or SAMEORIGIN	Header missing	High	X-Frame-Options: DENY

Privacy

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Referrer-Policy	❌ Missing		strict-origin-when-cross-origin / same-origin	Header missing	Medium	Referrer-Policy: strict-origin-when-cross-origin

Browser Features

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Permissions-Policy	❌ Missing		camera=(); geolocation=(); microphone=()	Permissions-Policy missing	Medium	Permissions-Policy: camera=(), geolocation=(), microphone=()

Cross-Origin

Check name	Status	Expected	Detail	Severity	Recommendation
Cross-Origin-Opener-Policy	❌ Missing	same-origin	Header missing	High	Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy	❌ Missing	require-corp	Header missing	High	Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy	❌ Missing	same-origin	Header missing	Medium	Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster	❌ Missing	?1	Header missing	Low	Origin-Agent-Cluster: ?1

Caching

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Cache-Control	✅ Passed	no-store, max-age=0	no-store, private, max-age=0	no-store, private, max-age=0	High	Cache-Control: no-store, private, max-age=0

Legacy

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
X-Permitted-Cross-Domain-Policies	❌ Missing		none	Header missing	Low	X-Permitted-Cross-Domain-Policies: none

CORS

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Access-Control-Allow-Origin	❌ Missing		Scoped origin (no wildcard)	Access-Control-Allow-Origin missing	Medium	Access-Control-Allow-Origin: https://app.example.com

Information Disclosure

Check name	Status	Actual	Expected	Detail	Severity	Recommendation
Server	❌ Missing	EasyRedir	Header removed or generic	Sensitive header exposed	High	Remove Server header or set to a generic token
X-Powered-By	✅ Passed		Header removed	Header not exposed	High	Remove X-Powered-By header
X-AspNet-Version	✅ Passed		Header removed	Header not exposed	Medium	Remove framework version headers

Raw headers

HTTP/2 301 
date: Sat, 31 Jan 2026 20:30:39 GMT
content-type: text/html
content-length: 155
location: https://www.barracuda.com/
er-request-id: 1a380cfa042dfc270d4de149e698cd0f
pragma: no-cache
cache-control: no-store, max-age=0
x-content-type-options: nosniff
er-rule-id: r-34a4535e-2fc6-4d0d-b459-c89d41886e30
server: EasyRedir