SEO report for galvinconstruction.com

The site lacks important security headers which can expose users to various security risks. Immediate actions are recommended to implement strict transport security, content security policy, clickjacking protection, and secure cookie settings to protect both the site and its visitors from potential threats.

• 0 high
• 4 medium
• 2 low
• 1 info

1. 1

   Missing HTTP Strict Transport Security (HSTS)Medium

   Why it matters: Without HSTS, visitors using HTTP can be intercepted on their first request.

   Fix: Add the header: Strict-Transport-Security: max-age=31536000; includeSubDomains

   Evidence: HTTP Strict Transport Security

2. 2

   Missing Content Security Policy (CSP)Medium

   Why it matters: Absence of CSP allows unrestricted loading of scripts, potentially leading to XSS attacks.

   Fix: Add the header: Content-Security-Policy: default-src 'self';

   Evidence: Content Security Policy

3. 3

   Missing X-Frame-Options for Clickjacking ProtectionMedium

   Why it matters: Lack of this protection allows the site to be embedded in malicious frames.

   Fix: Add the header: X-Frame-Options: DENY

   Evidence: Clickjacking protection

4. 4

   Unprotected Cookie FlagsMedium

   Why it matters: Cookies without proper flags can be vulnerable to theft and cross-site request forgery.

   Fix: Set the cookie with flags: HttpOnly, Secure, SameSite=Lax

   Evidence: Cookie flags

5. 5

   Missing X-Content-Type-OptionsLow

   Why it matters: Without this header, browsers may execute files as scripts based on their content.

   Fix: Add the header: X-Content-Type-Options: nosniff

   Evidence: MIME sniffing protection

6. 6

   Missing Referrer PolicyLow

   Why it matters: Without this policy, sensitive URL information can be exposed when navigating to other sites.

   Fix: Add the header: Referrer-Policy: no-referrer-when-downgrade

   Evidence: Referrer policy

7. 7

   Missing Permissions PolicyInfo

   Why it matters: Not specifying permissions can leave browser features open to misuse by potential attackers.

   Fix: Add the header: Permissions-Policy: geolocation=(self), microphone=(), camera=()

   Evidence: Permissions policy

A passive review of what the crawl recorded: response headers, page and script contents and the URLs it found. It does not probe the site, test TLS settings or look for files that were not linked. Generated automatically; verify each finding against your own site before acting on it.