This scan was made by Website Security Scanner at webscanner.unofix.no

36/100
High risk

Scanned URL: adm.thix.com.br

2026-04-07 01:02:31
🛡️
Security Headers
0
🔒
SSL / HTTPS
100
🍪
Cookies
5
📂
Exposed Files
0
🖥️
Server Info
100
❌ Security Headers 0%

Security headers are HTTP response headers that tell the browser how to handle a website’s content in a secure way.

0 of 8 recommended security headers found (0% score)

Header Status Value Description
X-Frame-Options ❌ Not set Protects against clickjacking attacks. Hackers can load your page in an invisible iframe and trick users into clicking buttons they cannot see (e.g. "Transfer money"). Status: Not set.
X-Content-Type-Options ❌ Not set Prevents MIME-sniffing. A malicious file pretending to be an image can be executed as JavaScript and steal user data. Status: Not set.
Strict-Transport-Security ❌ Not set Enforces HTTPS usage (HSTS). Without HTTPS, attackers on the same WiFi network can intercept all communication and steal passwords in plain text. Status: Not set.
Content-Security-Policy ❌ Not set Controls which resources can be loaded. Malicious scripts from third parties can run on your page and steal user data or spread malware. Status: Not set.
Referrer-Policy ❌ Not set Controls what referrer information is sent. Sensitive URLs (e.g. /reset-password?token=abc123) can leak to third parties via analytics or ads. Status: Not set.
Permissions-Policy ❌ Not set Controls access to browser features (camera, microphone, GPS). Malicious code or third-party scripts can secretly activate camera/microphone and spy on the user. Status: Not set.
Cross-Origin-Opener-Policy ❌ Not set Isolates your window from cross-origin windows. A malicious popup window can read data from your page via window.opener and steal sensitive information. Status: Not set.
Cross-Origin-Resource-Policy ❌ Not set Controls who can load your resources. Other websites can steal bandwidth by hotlinking to your images, or read pixel data from cross-origin images. Status: Not set.
❌ Exposed Files & Information Disclosure 0%

2 sensitive file(s) found publicly accessible. Immediate action required.

Item Information
/.git/HEAD
🔴 CRITICAL 		Version control files are publicly accessible
Git repository exposed - source code can be downloaded
/.git/config
🔴 CRITICAL 		Version control files are publicly accessible
Git config exposed - repository metadata leak
✅ SSL/TLS Security 100%

Valid SSL certificate from trusted Certificate Authority. Certificate expires in 34 days.

📜 SSL Certificate Information
Status ✅ Valid
Issued To adm.thix.com.br
Issued By R12
Valid Until 2026-05-11 00:11:38
Days Until Expiry 34 days
❌ Cookie Security 5%

1 of 1 cookie(s) have CRITICAL security issues including auth/session cookies (5% score) - Immediate action required!

Cookie Name Security Flags Score Risk Issues
PHPSESSID
f988...3f0f
❌ Secure❌ HttpOnly❌ SameSite
 15% 🔴 CRITICAL
  • 🔴 CRITICAL: Missing HttpOnly flag on auth cookie - Session can be stolen via XSS attacks
  • Missing SameSite flag - Vulnerable to CSRF attacks
  • 🔴 CRITICAL: Missing Secure flag on auth cookie over HTTPS - Session can be intercepted
  • +2 more issue(s)
✅ Server Information Disclosure 100%

1 server information header(s) disclosed. Consider hiding these to reduce attack surface.

Header Status Value Risk
Server ❌ Exposed Apache Server software disclosed (Apache) but no version number. Consider hiding this header completely.
X-Powered-By ✅ Hidden Not present Header not present (good - no information disclosure)
X-AspNet-Version ✅ Hidden Not present Header not present (good - no information disclosure)
X-AspNetMvc-Version ✅ Hidden Not present Header not present (good - no information disclosure)
X-Generator ✅ Hidden Not present Header not present (good - no information disclosure)
🏠 Scan Another Website