mservice.com.vn

Check result

The assessment could not determine whether password forms on the inspected homepage use HTTPS for both the page and submission URL.

Why it matters

If either a password page or the address receiving its form uses HTTP, someone observing the network may read or change the submitted password.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether every session-like cookie observed on the homepage response uses HttpOnly.

Why it matters

HttpOnly prevents browser scripts from directly reading a cookie. It does not fix script injection, but it makes theft of session and authentication cookies more difficult.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether every session-like cookie observed on the homepage response uses Secure.

Why it matters

The Secure attribute prevents a browser from sending a cookie over unencrypted HTTP. This bounded check scores cookies whose names look session- or authentication-related; other cookies are reported as context but do not by themselves prove that sensitive data is exposed.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether the homepage CORS probe does not reflect the arbitrary test origin with credentials or another broadly permissive combination.

Why it matters

Cross-Origin Resource Sharing (CORS) decides which websites may read responses from this service in a visitor's browser. Rules that trust arbitrary origins, especially with login cookies, can expose private data to another website.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether the inspected homepage HTML response has a CSP without a broad or unsafe directive recognized by this bounded check.

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

References

Check result

The assessment could not determine whether the domain registration is valid beyond the near-term renewal threshold.

Why it matters

An expired domain stops directing users to the organization's services and may eventually become available to someone else. A domain close to expiry leaves little time to recover from payment or account problems.

Diagnostic information

The domain-registration source did not return enough reliable evidence.

Check result

The assessment could not determine whether the registration status contains no hold, redemption, or pending-deletion signal recognized by this check.

Why it matters

Registrar or registry restrictions such as hold, redemption, or pending deletion can disable the domain. If they are not resolved, the organization may lose control of its website and email identity.

Diagnostic information

The domain-registration source did not return enough reliable evidence.

Check result

The assessment could not determine whether observed homepage cookies use an explicit SameSite setting and do not combine SameSite=None with missing Secure.

Why it matters

SameSite limits when a browser includes cookies in requests started by another website. This helps prevent another site from silently making an authenticated request on a user's behalf.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether the inspected homepage restricts framing with CSP frame-ancestors or X-Frame-Options.

Why it matters

Another website can place this page inside a hidden or misleading frame and trick a user into clicking an unintended action. Frame restrictions tell browsers which sites, if any, may embed the page.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

References

Check result

The assessment could not determine whether the inspected HTTPS homepage contains no active resource or form destination over HTTP.

Why it matters

An HTTPS page can still load scripts, frames, styles, or forms over unencrypted HTTP. An attacker on the network may alter that content and compromise the otherwise secure page.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether the inspected homepage response sets X-Content-Type-Options to nosniff.

Why it matters

Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

References

Check result

The assessment could not determine whether the inspected homepage HTTPS response contains an effective HSTS policy.

Why it matters

HTTP Strict Transport Security (HSTS) tells a browser to use HTTPS automatically on future visits. This reduces the chance that a visitor is downgraded to an unencrypted connection.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether the homepage redirects directly from HTTP to HTTPS on the first hop and no later redirect downgrades to HTTP.

Why it matters

Visitors may enter an address beginning with HTTP or follow an old link. Redirecting them immediately to HTTPS prevents the rest of the visit from continuing over an unencrypted connection.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether the inspected homepage does not match a common automatic directory-listing pattern.

Why it matters

When a web server automatically lists a directory, visitors may discover files that were never linked publicly, including backups, logs, or deployment artifacts.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether the inspected homepage sets Permissions-Policy without a broad grant recognized by this bounded check.

Why it matters

Permissions-Policy can further restrict browser features such as the camera, microphone, and location for this page and embedded content. Each feature already has a browser-defined default allowlist, so an absent header does not mean that every feature is unrestricted.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

References

Check result

The assessment could not determine whether the inspected homepage explicitly sets a privacy-preserving Referrer-Policy.

Why it matters

When a visitor follows a link, the browser may send information about the previous URL to the destination. Modern browsers default to strict-origin-when-cross-origin when no header is sent, so an absent header is a hardening gap rather than proof that a full sensitive URL was exposed.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

References

Check result

The assessment could not determine whether the inspected homepage HSTS policy lasts at least 180 days.

Why it matters

The max-age value controls how long browsers remember to use HTTPS. A very short period provides limited protection, while includeSubDomains also covers every subdomain and can break one that does not support HTTPS.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

The assessment could not determine whether the inspected homepage response exposes no explicit software-version token recognized by this check.

Why it matters

Exact web server or framework versions help attackers quickly look for known weaknesses that may apply. Hiding a version is not a substitute for patching, but unnecessary disclosure gives away useful targeting information.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Check result

Technology fingerprints could not be evaluated from the root response.

Why it matters

Response headers, page content, and other public clues suggest which technologies the service uses. These observations help explain the attack surface, but they can be incomplete or mistaken and do not by themselves confirm a vulnerability.

Diagnostic information

Product identification did not complete for all observed services.

Check result

Passive WAF and edge signals were unavailable because no root response was obtained.

Why it matters

This check looks for bounded passive signals of a Web Application Firewall (WAF), CDN, or other edge service. A match suggests presence but does not test enforcement, and no match does not prove absence.

Diagnostic information

The scanner did not obtain a reliable enough website response to conclude this check.