HTTP Status
302
Redirecting (302)
Response Time
694ms
Last check
Uptime
100.0%
6 checks recorded
TLS
A
40 days
Headers
A+
Score: 90/100
Critical Findings
0
0 high
Asset Details
| URL | https://ri.dexoshouse.com |
| Environment | Production |
| Exposure | Internet-facing |
| Importance | High |
| Technology | django 2.2.8 |
| Owner | shriram |
| Scan Auth. | ✓ Authorised |
| Last Checked | 22 Aug 2026 18:22:42 |
TLS / SSL Certificate
HTTPS
✓ Enabled
Certificate
✓ Valid
Hostname
✓ Match
HSTS
✓ Enabled
HTTP→HTTPS
✓ Pass
Expires in
40 days (02 Oct 2026)
Security Headers — Grade: A+
HSTSPass
CSPWarning
X-Content-Type-OptionsPass
Referrer-PolicyPass
Permissions-PolicyPass
X-Frame-OptionsPass
Note: A missing header does not necessarily mean the site is vulnerable. Security headers reduce browser-side risk depending on the application's design.
IncidentsAll →
No incidents
Real-Time Security Findings & Vulnerabilities (0)
View all findings →
No Security Findings Detected
Live health and header audits found no immediate vulnerability flags.
Observatory Security Evaluation Breakdown
Grade: A+ (90/100)
| Test | Score | Reason | Recommendation |
|---|---|---|---|
| Content Security Policy (CSP) | -20 Failed | Content Security Policy (CSP) implemented unsafely. Contains 'unsafe-inline' or overly broad script/object sources. | Remove unsafe-inline and data: from script-src, restrict object-src and script-src directives. |
| Cookies | 0 Passed | All cookies use the Secure flag, session cookies use HttpOnly, and SameSite restrictions are in place. | None |
| Cross-Origin Resource Sharing (CORS) | 0 Passed | Content is not insecurely exposed via wildcard CORS headers. | None |
| Redirection | 0 Passed | Initial redirection is to HTTPS on the same host. | None |
| Referrer Policy | 0 Passed | Referrer-Policy header set to safe value: strict-origin-when-cross-origin. | None |
| Strict Transport Security (HSTS) | 0 Passed | Strict-Transport-Security header set (max-age=63072000; includeSubDomains; preload). | Consider preloading: add includeSubDomains and preload directives with max-age >= 31536000. |
| Subresource Integrity (SRI) | 0 Info | Subresource Integrity (SRI) not evaluated on static HTML response. | Add integrity attributes to external CDN script and style tags for bonus security. |
| X-Content-Type-Options | 0 Passed | X-Content-Type-Options header set to nosniff. | None |
| X-Frame-Options | 0 Passed | X-Frame-Options configured (DENY). | None |
| Cross Origin Resource Policy (CORP) | 0 Passed | Cross Origin Resource Policy set (same-origin). | None |