Website Security Audit Report

\n \n

Security Report Summary

\n \n \n \n \n \n

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

Site:	https://employee-discount.purolab.net/login/?iss=https%3A%2F%2Fpurolator.okta.com
Report Time:	October 26, 2025 at 05:03 PM
Headers:	\n \n ✗ Content-Security-Policy✓ Strict-Transport-Security✓ X-Content-Type-Options✗ X-Frame-Options✓ Referrer-Policy✗ Permissions-Policy\n \n
Critical Issues:	0
Warnings:	5

\n\n \n

Warnings

\n \n

\n 5 warnings detected\n

See the Configuration Issues section below for more info.

\n\n \n

Raw Headers

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

Header	Status	Value
connection	present	close
content-type	present	text/html
date	present	Sun, 26 Oct 2025 17:03:11 GMT
cache-control	present	public, must-revalidate, max-age=30
etag	present	"06978697"
last-modified	present	Thu, 25 Sep 2025 16:06:14 GMT
transfer-encoding	present	chunked
vary	present	Accept-Encoding
strict-transport-security	present	max-age=10886400; includeSubDomains; preload
referrer-policy	present	same-origin
x-content-type-options	present	nosniff
x-xss-protection	present	1; mode=block
x-dns-prefetch-control	present	off

\n\n \n

Security Findings

\n \n \n

Vulnerabilities

No vulnerabilities parsed from output.

\n \n \n

Configuration Issues

\n \n

Content Security Policy (CSP)

The absence of a Content Security Policy (CSP) header makes the site vulnerable to various forms of attacks, such as Cross-Site Scripting (XSS) and data injection attacks.

\n \n \n

X-Frame-Options

This header prevents the webpage from being embedded in a frame or iframe, mitigating the risk of clickjacking attacks.

\n \n \n

Secure and HttpOnly Flags

Cookies should have the `Secure` and `HttpOnly` flags set to ensure they are only transmitted over HTTPS and are not accessible via JavaScript.

\n \n \n

Mixed Content

If the site is served over HTTPS, it's crucial to ensure all resource requests (such as images, stylesheets, and scripts) are also made over HTTPS.

\n \n \n

\n \n

Additional Information

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

access-control-allow-origin	This is a very lax CORS policy. Such a policy should only be used on a public CDN.
strict-transport-security	HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
content-security-policy	Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.
permissions-policy	Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
referrer-policy	Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
x-content-type-options	X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-frame-options	X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
report-to	Report-To enables the Reporting API. This allows a website to collect reports from the browser about various errors that may occur. You can sign up for a free account on Report URI to collect these reports.
nel	Network Error Logging is a new header that instructs the browser to send reports during various network or application errors. You can sign up for a free account on Report URI to collect these reports.
server	Server value has been changed. Typically you will see values like "Microsoft-IIS/8.0" or "nginx 1.7.2".

\n \n

\n \n \n

Implementation Guide

This report highlights security issues detected through client-side analysis. For a comprehensive security assessment, consider engaging a professional penetration tester.

\n \n

To implement the fixes above:

Work with your development team to address each issue in order of criticality
Retest after implementing each fix
Consider implementing a web application firewall for additional protection

\n \n \n

This report was automatically generated and represents an automated assessment of publicly accessible aspects of your website. For a more comprehensive security assessment, consider engaging with a professional security consultant.