Security
The Security score group: transport security, compromise signals, compliance, and blocked content
Security is one of the four score groups on every report. This page covers transport and header hardening: HTTPS, response headers, cookie flags, form submission and secrets that reached the browser. Signs of compromise, legal compliance signals and content blocked by privacy filters are scored in the same group but documented in the categories below.
Categories
Signs of compromise: injected pages, phishing kits, malware, SEO spam (9 rules)
Privacy policy and legal compliance signals (4 rules)
Content, links, and trackers blocked by ad blockers and privacy filters (3 rules)
Security rules
HTTPS, headers, and safe link practices (16 rules).
A missing CSP, a report-only policy or an unsafe-inline script-src leaves XSS unmitigated. squirrel parses the header and names each gap.
SameSite=None without Secure is rejected outright, and a session cookie without HttpOnly is readable by any script. squirrel parses every Set-Cookie.
An external link with target=_blank and no rel gives the opened page a handle on yours. squirrel lists every one, per page.
A contact or newsletter form with no bot protection collects spam within days. squirrel classifies forms and flags the unprotected public ones.
A form on an HTTPS page that posts to http:// sends the data in the clear and browsers interstitial it. squirrel checks action and formaction.
A missing or short Strict-Transport-Security header leaves the first request downgradeable. squirrel reads the header and checks max-age.
squirrel requests the http:// version of a sample of your URLs and reports which ones redirect to HTTPS, with the status code of the first hop.
A page delivered over plain HTTP can be read and rewritten in transit. squirrel flags every crawled URL whose protocol is not https.
An API key shipped in HTML or a bundle can be read by anyone who views source. squirrel scans every page and script against 87 key patterns.
An HTTPS page that loads a script or stylesheet over HTTP is not secure and browsers block it. squirrel lists every HTTP resource per page.
Without a Permissions-Policy, embedded frames inherit access to camera, microphone and geolocation. squirrel reads the header once per site.
unsafe-url sends the full URL, query string included, to every site you link to. squirrel reads the header and flags the leaky values.
Cross-origin scripts and stylesheets with no integrity hash can be swapped by a compromised CDN. squirrel lists every one, page by page.
Trackers and 1x1 pixels set cookies from domains you do not control. squirrel inventories the third-party scripts, iframes and pixels per page.
Without nosniff a browser may execute an uploaded file as script because the bytes look like one. squirrel reads the header once per site.
With no X-Frame-Options and no frame-ancestors, any site can iframe your pages and overlay them. squirrel checks both headers together.
Disable all Security rules
[rules]
disable = ["security/*"]Every audit reports Security findings next to the SEO, performance and agent experience rules. See Website security scan with AI for how an agent works through a report.