seznam.cz

Why it matters

The Secure attribute prevents a browser from sending a cookie over unencrypted HTTP. Without it, session or authentication data may be exposed to someone observing the network.

What to do

Set Secure on every session, authentication, and other sensitive cookie served by the HTTPS application.

Evidence and check scope

Total:

4

Cookies using Secure:

3

Cookies using HttpOnly:

2

Cookies missing SameSite:

0

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.

Evidence and check scope

Why it matters

A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.

What to do

After every legitimate sender passes DMARC, move gradually to quarantine and then reject, covering 100% of messages.

Evidence and check scope