D
64/100

Security posture: Needs work. Passive scan · 20 checks · HTTP/1.1 · HTTP 200.

Speed test →
Critical
0
fix immediately
High
0
serious risk
Medium
2
should address
Low / Info
4
hardening

Findings (worst first · 2 passed)

  • ! Medium HSTS not enabled · Headers
    Without Strict-Transport-Security, a first request can be downgraded to HTTP (SSL-strip).
    Fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains.
  • ! Medium Missing X-Frame-Options header · Headers
    Blocks the site being framed — anti-clickjacking.
    Fix: Add the X-Frame-Options response header.
  • • Low Missing X-Content-Type-Options header · Headers
    Stops MIME-type sniffing (nosniff).
    Fix: Add the X-Content-Type-Options response header.
  • • Low Missing Referrer-Policy header · Headers
    Controls how much referrer URL is leaked to other sites.
    Fix: Add the Referrer-Policy response header.
  • • Low Missing Permissions-Policy header · Headers
    Restricts access to camera, mic, geolocation, etc..
    Fix: Add the Permissions-Policy response header.
  • • Low X-Powered-By header exposes the tech stack · Disclosure
    “Express” tells attackers exactly what to target.
    Fix: Remove the X-Powered-By header.
  • ✓ Pass Served over HTTPS · Transport
    The connection is TLS-encrypted.
  • ✓ Pass No exposed sensitive files found · Exposure
    Checked 10 well-known risky paths (.git, .env, backups, phpinfo, …) — none were reachable.

Security Headers

Missing Strict-Transport-Security Forces browsers to use HTTPS (HSTS) — blocks SSL-strip attacks
Present Content-Security-Policy Whitelists resource origins — the strongest defence against XSS
Missing X-Content-Type-Options Stops MIME-type sniffing (nosniff)
Missing X-Frame-Options Blocks the site being framed — anti-clickjacking
Missing Referrer-Policy Controls how much referrer URL is leaked to other sites
Missing Permissions-Policy Restricts access to camera, mic, geolocation, etc.

TLS Certificate

Tls13 Negotiated protocol
Issuer WE1
84d Valid 2026-07-14 → 2026-10-12
Yes HTTP redirects to HTTPS
Off HSTS (Strict-Transport-Security)

Cookies

NoneThe homepage set no cookies on this request.

Sensitive File Exposure

403 https://www.prothomalo.com/.git/config
403 https://www.prothomalo.com/.env
403 https://www.prothomalo.com/.svn/entries
403 https://www.prothomalo.com/config.php.bak
403 https://www.prothomalo.com/wp-config.php.bak
403 https://www.prothomalo.com/.htaccess
403 https://www.prothomalo.com/phpinfo.php
404 https://www.prothomalo.com/server-status
403 https://www.prothomalo.com/.DS_Store
404 https://www.prothomalo.com/backup.zip

Only well-known, low-risk paths are checked — no directory brute-forcing.

How this works: StatVoid ran a passive scan of prothomalo.com — only ordinary GET requests to public URLs, reading the headers, cookies, TLS certificate and a short list of well-known sensitive paths the server exposes. Nothing was attacked, injected or brute-forced. Grades are a guide, not a certification. Want performance too? Run the page speed test for prothomalo.com.