whitton.io

HTML metadata

Technology

CDN

Cloudflare

jQuery

1.9.1 known XSS (<3.5)

Analytics

• Cloudflare Insights

Fonts

• Google Fonts

Third-party hosts loaded (3)

• ajax.googleapis.com×1
• fonts.googleapis.com×1
• static.cloudflareinsights.com×1

Social

• twitter
• github
• facebook
• medium

DNS records live

NS

• hank.ns.cloudflare.com
• ruth.ns.cloudflare.com

MX

• 1 aspmx.l.google.com
• 10 alt3.aspmx.l.google.com
• 10 alt4.aspmx.l.google.com
• 5 alt1.aspmx.l.google.com
• 5 alt2.aspmx.l.google.com

Verified for

• Google

Email authentication weak

SPF

not published

DMARC

not published

DKIM

no key found at common selectors

Certificate (current)

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 35/100 Checked live page: https://whitton.io/

present

• permissions-policy

findings

• missing HSTS
• missing Content Security Policy
• missing frame protection
• missing content type protection
• missing Referrer Policy

Links to (28)

• windows.net×1
• wikipedia.org×1
• w3.org×1
• uber.com×1
• twobotechnologies.com×1
• twitter.com×1
• synack.com×1
• portswigger.net×1
• philippeharewood.com×1
• owasp.org×1
• office.com×1
• oauthsecurity.com×1
• nealpoole.com×1
• mozilla.org×1
• microsoftonline.com×1
• messenger.com×1
• medium.com×1
• mazinahmed.net×1
• mademistakes.com×1
• live.com×1
• libpng.org×1
• jekyllrb.com×1
• idontplaydarts.com×1
• github.com×1
• flickr.com×1
• facebook.com×1
• bugcrowd.com×1
• akamaihd.net×1