Security Report Summary
B
| Site: | https://www.pitt.edu/ | ||
|---|---|---|---|
| IP Address: | 2a04:4e42:a::645 | ||
| Report Time: | 17 May 2024 10:00:54 UTC | ||
| Headers: |
|
||
| Warning: | Grade capped at A, please see warnings below. | ||
| Advanced: |
|
Missing Headers
| Referrer-Policy | Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. |
|---|
Warnings
| Strict-Transport-Security | The "max-age" directive is too small. The minimum recommended value is 2592000 (30 days). |
|---|---|
| Content-Security-Policy | This policy contains 'unsafe-inline' which is dangerous in the default-src directive. This policy contains 'unsafe-inline' which is dangerous in the script-src directive. This policy contains 'unsafe-eval' which is dangerous in the script-src directive. |
Raw Headers
| HTTP/2 | 200 |
|---|---|
| cache-control | max-age=600, public |
| content-encoding | gzip |
| content-language | en |
| content-security-policy | default-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.authorize.net *.google.com cdnjs.cloudflare.com cdn.rawgit.com maps.googleapis.com rw1.marchex.io connect.facebook.net googleads.g.doubleclick.net *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.gstatic.com cdn.jsdelivr.net *.youtube.com s.ytimg.com *.googlesyndication.com *.hotjar.com *.createsend1.com *.newrelic.com *.nr-data.net blob:; object-src 'self'; style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com fonts.googleapis.com tagmanager.google.com *.gstatic.com *.typekit.net *.google.com; img-src 'self' 'unsafe-inline' data: maps.googleapis.com px.marchex.io *.facebook.com *.google.com *.gstatic.com cdn.rawgit.com raw.githubusercontent.com *.g.doubleclick.net *.google-analytics.com *.googletagmanager.com; frame-src 'self' 'unsafe-inline' *.doubleclick.net *.google.com players.brightcove.net *.youtube.com *.googletagmanager.com *.zensource.cloud vars.hotjar.com *.vimeo.com; font-src data: 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com use.typekit.net; connect-src 'self' 'unsafe-inline' *.authorize.net *.facebook.com *.google-analytics.com stats.g.doubleclick.net www.google.com *.hotjar.com wss://*.hotjar.com createsend.com; report-uri /report-csp-violation |
| content-type | text/html; charset=UTF-8 |
| etag | W/"1715924033" |
| expires | Sun, 19 Nov 1978 05:00:00 GMT |
| last-modified | Fri, 17 May 2024 05:33:53 GMT |
| permissions-policy | interest-cohort=() |
| server | nginx |
| strict-transport-security | max-age=300 |
| x-content-type-options | nosniff |
| x-drupal-cache-contexts | languages:language_interface layout_builder_is_active:node route theme timezone url.path url.query_args:_wrapper_format url.site user user.node_grants:view |
| x-drupal-cache-max-age | -1 (Permanent) |
| x-drupal-cache-tags | block_content:1 block_content:13 block_content:5 block_content_view block_view config:block.block.alert config:block.block.breadcrumbs config:block.block.collegesschools config:block.block.footerbackgroundimage config:block.block.footerblocks config:block.block.footercontact config:block.block.footerlogoandlinks config:block.block.footermainmenuandquicklinks config:block.block.footerquicklinks_2 config:block.block.footerquicklinksandcontact config:block.block.footerquicklinkscolumn1 config:block.block.footerquicklinkscolumn2 config:block.block.footersiteinformation config:block.block.globalmenu config:block.block.globalmenu_4 config:block.block.hamburgermenu_2 config:block.block.hamburgermenulower_2 config:block.block.hamburgermenulowercolumn1_2 config:block.block.hamburgermenulowercolumn2_2 config:block.block.hamburgermenuupper config:block.block.hamburgermenuuppercolumn1_2 config:block.block.hamburgermenuuppercolumn2_2 config:block.block.hamburgersearchmodal config:block.block.home_hero config:block.block.infomenu config:block.block.mainnavigation config:block.block.mainnavigation_4 config:block.block.navigation config:block.block.pitt_default_help config:block.block.pitt_default_local_tasks_block config:block.block.pitt_default_mainnavigation config:block.block.pitt_default_mainpagecontent config:block.block.pitt_default_messages config:block.block.pitt_default_primaryadminactions config:block.block.pitt_default_sitebranding config:block.block.quicklinks1 config:block.block.quicklinks2 config:block.block.quicklinks3 config:block.block.sitebranding config:block.block.socialmedialinks config:block.block.socialmedialinks_3 config:block.block.tier_hero config:block_list config:blockgroup.block_group_content.footer_blocks config:blockgroup.block_group_content.footer_contact config:blockgroup.block_group_content.footer_logo_and_links config:blockgroup.block_group_content.footer_main_menu_and_quick_links config:blockgroup.block_group_content.footer_quick_links config:blockgroup.block_group_content.footer_quick_links_and_contact config:blockgroup.block_group_content.footer_quick_links_column_1 config:blockgroup.block_group_content.footer_quick_links_column_2 config:blockgroup.block_group_content.hamburger_menu config:blockgroup.block_group_content.hamburger_menu_lower config:blockgroup.block_group_content.hamburger_menu_lower_column_1 config:blockgroup.block_group_content.hamburger_menu_lower_column_2 config:blockgroup.block_group_content.hamburger_menu_upper config:blockgroup.block_group_content.hamburger_menu_upper_ config:blockgroup.block_group_content.hamburger_menu_upper_column_1 config:core.entity_view_display.block_content.image.background_image config:core.entity_view_display.block_content.site_information.default config:core.entity_view_display.media.image.media_gallery config:core.entity_view_display.media.video.autoplay_video_home config:core.entity_view_display.node.home_page.default config:core.entity_view_display.paragraph.basic_content.default config:core.entity_view_display.paragraph.link_and_text.default config:extlink.settings config:filter.format.basic_html config:filter.format.new_editor config:fixed_block_content.fixed_block_content.footer_background_image config:fixed_block_content.fixed_block_content.footer_site_information config:fixed_block_content.fixed_block_content.hamburger_search_modal config:image.style.media_gallery config:paragraphs.settings config:system.menu.global-menu config:system.menu.info-menu config:system.menu.main config:system.menu.quick-links-1 config:system.menu.quick-links-2 config:system.menu.quick-links-3 config:system.site config:user.role.anonymous file:5972 file:5980 file:6502 file:6515 file:6610 file:7054 file:7179 file:7197 file:7442 file:7625 file:7697 file:7768 file:7769 file:7913 file:7960 file:8146 file:8241 file:8427 http_response local_task media:1 media:5 media:5657 media:5658 media:5659 media:5661 media:5662 media:5663 media:5664 media:5665 media:5672 media:5674 media:5675 media:5676 media:5680 media:5681 media:5881 media:5883 media:6405 media:6417 media:6502 media:6929 media:7052 media:7071 media:7176 media:7308 media:7490 media:7553 media:7626 media:7627 media:7667 media:7754 media:7801 media:7982 media:8076 media:8124 media:8257 media:8273 media:8717 media:8810 media_view node:1 node:13530 node:13534 node:13544 node:13874 node:13876 node:14189 node:14206 node:14262 node:14589 node:14661 node:14662 node:14828 node:14959 node:15004 node:15038 node:15039 node:15116 node:15151 node:15225 node:15391 node:18 node:23 node:28 node:29 node:31 node_view paragraph:164 paragraph:165 paragraph:166 paragraph:167 paragraph:168 paragraph:169 paragraph:170 paragraph:172 paragraph:173 paragraph:174 paragraph:177 paragraph:179 paragraph:1991 paragraph:2 paragraph:2267 paragraph:2270 paragraph:2271 paragraph:2273 paragraph:2328 paragraph:2525 paragraph:2601 paragraph:880 paragraph_view rendered taxonomy_term:23 taxonomy_term:407 taxonomy_term:409 taxonomy_term:410 taxonomy_term:411 taxonomy_term:415 taxonomy_term_view user:0 user:1 user:26 user:29 user:73 user:90 |
| x-frame-options | SAMEORIGIN |
| x-pantheon-styx-hostname | styx-fe1-b-5c49f7f666-gmq76 |
| x-styx-req-id | 3b2428bf-140f-11ef-bb38-a25619130371 |
| x-ua-compatible | IE=edge |
| x-xss-protection | 1; mode=block |
| age | 45 |
| accept-ranges | bytes |
| via | 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish |
| date | Fri, 17 May 2024 10:00:54 GMT |
| x-served-by | cache-chi-klot8100034-CHI, cache-sjc10071-SJC, cache-sjc10071-SJC, cache-sjc10040-SJC |
| x-cache | HIT, HIT, MISS, MISS |
| x-cache-hits | 15, 1, 0, 0 |
| x-timer | S1715940055.874498,VS0,VE6 |
| vary | Accept-Encoding, Cookie, Cookie, Cookie, orig-host |
| content-length | 29008 |
Upcoming Headers
| Cross-Origin-Embedder-Policy | Cross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP. |
|---|---|
| Cross-Origin-Opener-Policy | Cross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser. |
| Cross-Origin-Resource-Policy | Cross-Origin Resource Policy allows a resource owner to specify who can load the resource. |
Additional Information
| content-security-policy | Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site. |
|---|---|
| permissions-policy | Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser. |
| server | This Server header seems to advertise the software being run on the server but you can remove or change this value. |
| strict-transport-security | HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. |
| x-content-type-options | X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff". |
| x-frame-options | X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. |
| x-xss-protection | X-XSS-Protection sets the configuration for the XSS Auditor built into older browsers. The recommended value was "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead. |