Security Report Summary
A
Site: | https://cipm.mcmc.gov.my/account/login | ||
---|---|---|---|
IP Address: | 2606:4700:3032::ac43:d13f | ||
Report Time: | 06 May 2024 02:41:03 UTC | ||
Headers: |
|
||
Advanced: |
|
Missing Headers
Content-Security-Policy | Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. |
---|
Warnings
Status code indicates error | The status code of the response indicates an error. Not all headers may be set when the response is an error. |
---|---|
Scan was blocked | We got a 403 when trying to scan, please ensure we aren't being blocked. You can find our IP addresses to allow scans in our FAQ. |
Raw Headers
HTTP/2 | 403 |
---|---|
date | Mon, 06 May 2024 02:41:03 GMT |
content-type | text/html; charset=UTF-8 |
accept-ch | Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA |
cross-origin-embedder-policy | require-corp |
cross-origin-opener-policy | same-origin |
cross-origin-resource-policy | same-origin |
origin-agent-cluster | ?1 |
permissions-policy | accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() |
cf-mitigated | challenge |
cf-chl-out | nFBLpv7r8koaS3LX4Oy73j4iNQ50sbaoPkvK7BAlqfWXE+WHgstSAFSkzZvl4kayh0Druouz00Luoo3Dt7FD/UvtHCHRMtpzPgMYCwu+IhBAu2DaFxItnyy1F3fdPAvFYrp5nxqiPqlz733cruHQzQ==$CRz3I7+EBwq9Lk5OBi8QWg== |
cache-control | private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 |
expires | Thu, 01 Jan 1970 00:00:01 GMT |
report-to | {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ygya8VHzmlRpJcW2sO2TEUVfK618vnMXKE9XBnllxswPnI9m%2FQ9SVHkiXaYaNCrtqqDx3a6Vb%2FFZmqpI9fnjb1eAx3pfstk2sGhipAs%2BAxt%2Bzk4A3clDl1dT6vPbYHA3O%2FxA5TTvd%2FVkR%2F%2BiJhf3"}],"group":"cf-nel","max_age":604800} |
nel | {"success_fraction":0,"report_to":"cf-nel","max_age":604800} |
vary | Accept-Encoding |
strict-transport-security | max-age=31536000; includeSubDomains; preload |
expect-ct | max-age=86400, enforce |
referrer-policy | same-origin |
x-content-type-options | nosniff |
x-frame-options | SAMEORIGIN |
x-xss-protection | 1; mode=block |
connect-src | 'self' https://jendela.my https://*.googleapis.com *.google.com https://*.gstatic.com https://www.google-analytics.com; data: blob:; |
default-src | 'self' 'unsafe-inline' 'unsafe-eval' |
font-src | 'self' https://fonts.gstatic.com; object-src 'none'; img-src 'self' https://jendela.my/tiles/ https://*.googleapis.com https://*.gstatic.com *.google.com *.googleusercontent.com data: blob:; |
frame-ancestors | 'none' |
frame-src | *.google.com; |
script-src | self' 'unsafe-inline' 'unsafe-eval' https://*.googleapis.com https://*.gstatic.com *.google.com https://*.ggpht.com *.googleusercontent.com blob: https://www.googletagmanager.com/gtag/js?id=G-KWHVDRTQ5G https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js https://cdn.jsdelivr.net/npm/[email protected]/dist/css/select2.min.css https://fonts.googleapis.com/css2 https://code.jquery.com/ui/1.12.1/jquery-ui.js https://cdn.jsdelivr.net/npm/[email protected]/dist/js/select2.min.js https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.9.4/Chart.js https://*.mcmc.gov.my; |
style-src | self' 'unsafe-inline' https://fonts.gstatic.com/s/mulish https://cdn.jsdelivr.net/npm/[email protected]/dist/css/select2.min.css https://fonts.googleapis.com; |
server | cloudflare |
cf-ray | 87f59bed0e801749-SJC |
content-encoding | gzip |
alt-svc | h3=":443"; ma=86400 |
Additional Information
cross-origin-embedder-policy | Cross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP. |
---|---|
cross-origin-opener-policy | Cross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser. |
cross-origin-resource-policy | Cross-Origin Resource Policy allows a resource owner to specify who can load the resource. |
permissions-policy | Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser. |
report-to | Report-To enables the Reporting API. This allows a website to collect reports from the browser about various errors that may occur. You can sign up for a free account on Report URI to collect these reports. |
nel | Network Error Logging is a new header that instructs the browser to send reports during various network or application errors. You can sign up for a free account on Report URI to collect these reports. |
strict-transport-security | HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. |
expect-ct | Expect-CT will soon be deprecated and can be removed. |
referrer-policy | Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. |
x-content-type-options | X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff". |
x-frame-options | X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. |
x-xss-protection | X-XSS-Protection sets the configuration for the XSS Auditor built into older browsers. The recommended value was "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead. |
server | Server value has been changed. Typically you will see values like "Microsoft-IIS/8.0" or "nginx 1.7.2". |