Persistent report

kesintisorgu.com.tr security headers report

Last analyzed: October 31, 2026 at 11:33 PM UTC

Available again in 5:00

URL

https://kesintisorgu.com.tr/izmir-elektrik-kesintisi.html

Status

200

HTTPS

To-do, by priority

Fails first, then warnings. Tips are things this HTML fetch cannot see.

Error

On HTTPS, cookies without Secure can leak on a downgrade. SameSite stops most CSRF.

Warning

Content-Security-Policy

Limits which scripts, frames and connections the page may use.

Warning

X-Powered-By

Advertises the stack to scanners. Not a ranking factor.

HSTSPass

max-age=31536000; includeSubDomains; preload

Why it matters: Tells browsers to skip HTTP entirely on the next visit.

Content-Security-PolicyWarning

CSP set

default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' https: data:; font-src 'self' https: data:; style-src 'self' https: 'unsafe-inline'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' https://cdn.tailwindcss.com https://unpkg.com https://www.googletagmanager.com https://www.google-analytics.com; connect-src 'self' https:;

Why it matters: Limits which scripts, frames and connections the page may use.

What to do

Start with default-src 'self' and add the origins you actually need. Avoid unsafe-inline if you can.

ClickjackingPass

sameorigin

Why it matters: X-Frame-Options or CSP frame-ancestors stop other sites framing yours.

X-Content-Type-OptionsPass

nosniff

Why it matters: nosniff stops the browser guessing MIME types for scripts and styles.

Referrer-PolicyPass

strict-origin-when-cross-origin

Why it matters: Controls how much of the URL leaks to the next site.

Permissions-PolicyPass

geolocation=(), microphone=(), camera=()

Why it matters: Restricts camera, geolocation, and similar APIs. Optional.

Cross-Origin-Opener-PolicyInfo

Not set

Why it matters: Isolates the browsing context from window.opener. Optional.

Cross-Origin-Resource-PolicyInfo

Not set

Why it matters: Stops other sites embedding this response. Optional.

X-XSS-ProtectionInfo

1; mode=block

Why it matters: Deprecated. Modern browsers ignore it; a leftover 1; mode=block can cause issues.

X-Powered-ByWarning

PHP/8.4.27, PleskLin

Why it matters: Advertises the stack to scanners. Not a ranking factor.

What to do

Remove the X-Powered-By header.

ServerInfo

cloudflare

Why it matters: Often a version string. Informational fingerprint.

CookiesError

Why it matters: On HTTPS, cookies without Secure can leak on a downgrade. SameSite stops most CSRF.

What to do

Set Secure; HttpOnly; SameSite=Lax (or Strict) on session cookies.

Security headers sent

server: cloudflare
x-powered-by: PHP/8.4.27, PleskLin
referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
permissions-policy: geolocation=(), microphone=(), camera=()
x-content-type-options: nosniff
content-security-policy: default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' https: data:; font-src 'self' https: data:; style-src 'self' https: 'unsafe-inline'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' https://cdn.tailwindcss.com https://unpkg.com https://www.googletagmanager.com https://www.google-analytics.com; connect-src 'self' https:;
strict-transport-security: max-age=31536000; includeSubDomains; preload

Cookie flags (values omitted)

Name	Secure	HttpOnly	SameSite
PHPSESSID	no	no	—

Get this report by email on a schedule, with what changed since last time.