Pricing Scan yoursScan your own site

A sample report for a fictional shop, laid out exactly as yours will be. Nothing here is live data.

Security report for Example Shop

Public scan of shop.example.com, finished 3 November 2026. Shared read-only.

C

Grade C

71 out of 100

Fair. Some problems an attacker could use.

Since last scan: 1 new3 fixed4 unchanged
Checks: 18 passed 4 failed 1 skipped

Critical: 0
High: 1
Medium: 2
Low: 1

What to fix first

Most severe first, confirmed before unsure.

1
HighSession cookie is sent without the Secure flag
Insecure cookie on https://shop.example.com/
Fix
1. Set the Secure flag on the session cookie so it is only ever sent over HTTPS.
2. Keep HttpOnly so scripts cannot read it, and add SameSite=Lax.
In Next.js, where the cookie is set:
```
cookies().set("session", id, { secure: true, httpOnly: true, sameSite: "lax" })
```
In Express: res.cookie("session", id, { secure: true, httpOnly: true, sameSite: "lax" }).
2
MediumNo Content-Security-Policy header
No Content-Security-Policy on https://shop.example.com/
Fix
Start with a policy that only allows your own origin and report violations before enforcing:
```
Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data:; script-src 'self'; object-src 'none'; frame-ancestors 'none'
```
On Vercel, add it under headers() in next.config.ts; on nginx, add_header Content-Security-Policy "…" always;. Once the report-only log is quiet, drop -Report-Only.
3
MediumjQuery 1.12.4 has known vulnerabilities
Vulnerable dependency on https://shop.example.com/assets/vendor.js
Fix
1. Upgrade to jQuery 3.7 (npm install jquery@3), or swap the CDN tag for https://code.jquery.com/jquery-3.7.1.min.js.
2. Run the site's pages once: the 3.x migration plugin lists any call that changed.
3. Add integrity="sha384-…" and crossorigin="anonymous" to the script tag.

High 1

Medium 2

Low 1

Info 1

Your report takes about five minutes: add your site, prove you own it, and the first scan is free.

Scan your own site