HTTP Status
200
Online
Response Time
894ms
Last check
Uptime
100.0%
10 checks recorded
TLS
B
52 days
Headers
F
Score: 0/100
Critical Findings
1
0 high
Asset Details
| URL | https://sahee.dexoshouse.com |
| Environment | Testing |
| Exposure | Internet-facing |
| Importance | Normal |
| Technology | django 1.2.2 |
| Owner | shriram |
| Scan Auth. | ✓ Authorised |
| Last Checked | 22 Aug 2026 23:17:46 |
TLS / SSL Certificate
HTTPS
✓ Enabled
Certificate
✓ Valid
Hostname
✓ Match
HSTS
✕ Missing
HTTP→HTTPS
✓ Pass
Expires in
52 days (14 Oct 2026)
Security Headers — Grade: F
HSTSNot Detected
CSPNot Detected
X-Content-Type-OptionsNot Detected
Referrer-PolicyNot Detected
Permissions-PolicyNot Detected
X-Frame-OptionsNot Detected
Note: A missing header does not necessarily mean the site is vulnerable. Security headers reduce browser-side risk depending on the application's design.
IncidentsAll →
[CRITICAL] CVE-2026-32475 Elementor Pro Vulnerabi…
Real-Time Security Findings & Vulnerabilities (1)
View all findings →
| Severity | Vulnerability / Finding | Source | Recommended Action |
|---|---|---|---|
| CRITICAL |
CVE-2026-32475: Critical Unauthenticated File Upload & RCE in Elementor Pro 4.2.1
MilesWeb Security Notice: Critical vulnerability CVE-2026-32475 discovered in Elementor Pro WordPress plugin version 4.…
|
MilesWeb Security Notice / CVE-2026-32475 | Log in to WordPress admin dashboard -> Plugins -> Installed Plugins -> Update Elementor Pro to version 4.2.2 or above immediately. |
Observatory Security Evaluation Breakdown
Grade: F (0/100)
| Test | Score | Reason | Recommendation |
|---|---|---|---|
| Content Security Policy (CSP) | -25 Failed | Content Security Policy (CSP) header is missing. | Implement a Content-Security-Policy header defining trusted script-src, style-src, and object-src directives. |
| Cookies | 0 Passed | No session cookies set by initial request. | None |
| Cross-Origin Resource Sharing (CORS) | 0 Passed | Content is not insecurely exposed via wildcard CORS headers. | None |
| Redirection | 0 Passed | Initial redirection is to HTTPS on the same host. | None |
| Referrer Policy | -5 Warning | Referrer-Policy header is missing or set to unsafe value. | Set Referrer-Policy header to strict-origin-when-cross-origin or no-referrer. |
| Strict Transport Security (HSTS) | -20 Failed | Strict-Transport-Security header missing or invalid. | Set Strict-Transport-Security header with max-age=31536000 and includeSubDomains. |
| Subresource Integrity (SRI) | 0 Info | Subresource Integrity (SRI) not evaluated on static HTML response. | Add integrity attributes to external CDN script and style tags for bonus security. |
| X-Content-Type-Options | -10 Failed | X-Content-Type-Options header is missing. | Set X-Content-Type-Options: nosniff on all HTTP responses. |
| X-Frame-Options | -15 Failed | X-Frame-Options header missing, allowing potential clickjacking. | Set X-Frame-Options: DENY or SAMEORIGIN (or frame-ancestors in CSP). |
| Cross Origin Resource Policy (CORP) | 0 Info | Cross Origin Resource Policy (CORP) not set. | Set Cross-Origin-Resource-Policy: same-origin or same-site. |