This scan was made by Website Security Scanner at webscanner.unofix.no

71/100
Can be improved

Scanned URL: hiphopdrops.com

2026-01-04 22:37:57
🛡️
Security Headers
0
🔒
SSL / HTTPS
100
🍪
Cookies
90
📂
Exposed Files
90
🖥️
Server Info
100
❌ Security Headers 0%

Security headers are HTTP response headers that tell the browser how to handle a website’s content in a secure way.

0 of 8 recommended security headers found (0% score)

Header Status Value Description
X-Frame-Options ❌ Not set Protects against clickjacking attacks. Hackers can load your page in an invisible iframe and trick users into clicking buttons they cannot see (e.g. "Transfer money"). Status: Not set.
X-Content-Type-Options ❌ Not set Prevents MIME-sniffing. A malicious file pretending to be an image can be executed as JavaScript and steal user data. Status: Not set.
Strict-Transport-Security ❌ Not set Enforces HTTPS usage (HSTS). Without HTTPS, attackers on the same WiFi network can intercept all communication and steal passwords in plain text. Status: Not set.
Content-Security-Policy ❌ Not set Controls which resources can be loaded. Malicious scripts from third parties can run on your page and steal user data or spread malware. Status: Not set.
Referrer-Policy ❌ Not set Controls what referrer information is sent. Sensitive URLs (e.g. /reset-password?token=abc123) can leak to third parties via analytics or ads. Status: Not set.
Permissions-Policy ❌ Not set Controls access to browser features (camera, microphone, GPS). Malicious code or third-party scripts can secretly activate camera/microphone and spy on the user. Status: Not set.
Cross-Origin-Opener-Policy ❌ Not set Isolates your window from cross-origin windows. A malicious popup window can read data from your page via window.opener and steal sensitive information. Status: Not set.
Cross-Origin-Resource-Policy ❌ Not set Controls who can load your resources. Other websites can steal bandwidth by hotlinking to your images, or read pixel data from cross-origin images. Status: Not set.
⚠️ Exposed Files & Information Disclosure 90%

2 sensitive file(s) found publicly accessible. Immediate action required.

Item Information
🔍 Detected Technology WordPress
/readme.html
🔵 LOW 		Version information is exposed
May reveal WordPress version number
/license.txt
🔵 LOW 		Version information is exposed
May reveal WordPress version number
✅ SSL/TLS Security 100%

Valid SSL certificate from trusted Certificate Authority. Certificate expires in 62 days.

📜 SSL Certificate Information
Status ✅ Valid
Issued To hiphopdrops.com
Issued By WE1
Valid Until 2026-03-08 05:37:16
Days Until Expiry 62 days
✅ Cookie Security 90%

2 of 2 cookie(s) are missing recommended security flags (90% score)

Cookie Name Security Flags Score Risk Issues
__cf_bm
ZXdZ...XYKI
🔒 Secure🛡️ HttpOnly✅ SameSite=None
 90% ✅ LOW
  • ℹ️ SameSite=None allows cross-site requests - Ensure this is intentional for third-party use
  • Broad domain scope (.hiphopdrops.com) - Cookie shared with all subdomains
  • Cookie sent to all paths (/) - Consider narrower scope if possible
_cfuvid
.t2p...0000
🔒 Secure🛡️ HttpOnly✅ SameSite=None
 90% ✅ LOW
  • ℹ️ SameSite=None allows cross-site requests - Ensure this is intentional for third-party use
  • ℹ️ Session cookie (expires when browser closes)
  • Broad domain scope (.hiphopdrops.com) - Cookie shared with all subdomains
  • +1 more issue(s)
✅ Server Information Disclosure 100%

1 server information header(s) disclosed. Consider hiding these to reduce attack surface.

Header Status Value Risk
Server ❌ Exposed cloudflare Server software disclosed (cloudflare) but no version number. Consider hiding this header completely.
X-Powered-By ✅ Hidden Not present Header not present (good - no information disclosure)
X-AspNet-Version ✅ Hidden Not present Header not present (good - no information disclosure)
X-AspNetMvc-Version ✅ Hidden Not present Header not present (good - no information disclosure)
X-Generator ✅ Hidden Not present Header not present (good - no information disclosure)
🏠 Scan Another Website