Netcraft website risk status, 7 red out of 10: http://toolbar.netcraft.com/site_report?url=http://cycloclubmerten.free.fr
JQuery version vulnerability: http://domstorm.skepticfx.com/modules?id=529bbe6e125fac0000000003
Security header scan:
X-Frame-Options
Uh oh! X-Frame-Options does not appear to be found in the site’s HTTP header, increasing the likelihood of successful clickjacking attacks.
Strict-Transport-Security
Uh oh! Strict-Transport-Security does not appear to be found in the site’s HTTP header, so browsers will not try to access your pages over SSL first.
Nosniff
Uh oh! nosniff does not appear to be found in the site’s HTTP header, allowing Internet Explorer the opportunity to deliver malicious content via data that it has incorrectly identified to be of a certain MIME type.
X-XSS-Protection
Uh oh! We didn’t detect any mention of X-XSS-Protection in headers anywhere, so there’s likely room to improve if we want to be as secure as possible against cross site scripting.
Promiscuous CORS Support
Good news! Access-Control-Allow-Origin: * wasn’t found in the site’s HTTP header, so XHR Cross Object Resource Sharing requests are prohibited or should be tuned to cycloclubmerten.free.fr’s desired settings.
Content Security Policy
Uh oh! We did not detect Content-Security-Policy , x-webkit-csp, or even x-webkit-csp-report-only in the site’s HTTP header, making XSS attacks more likely to succeed.
UTF-8 Character Encoding
Uh oh! utf-8 doesn’t appear to be declared in this site’s HTTP header, increasing the likelihood that malicious character conversion could happen. Maybe it is declared in the actual HTML on the site’s pages. We hope so.
Server Information
Uh oh! Server: was found in this site’s HTTP header, possibly making it easier for attackers to know about potential vulnerabilities that may exist on your site!
X-Powered-By
Good news! X-Powered-By was not found in this site’s HTTP header, making it harder for attackers to know about potential vulnerabilities that may exist on your site!
Cross Domain Meta Policy
Uh oh! Permitted-Cross-Domain-Policies does not appear to be found in the site’s HTTP header, so it’s possible that cross domain policies can be set by other users on your site and be obeyed by Adobe Flash and pdf files…
polonus
