Web security: headers, TLS, DNS and cookies

The Web Security tab of an external scan shows how well protected the websites you publish on the internet are. It groups four checks into four sub-tabs: HTTP headers, SSL/TLS certificates, DNS security and cookies.

Summary

In this lesson you open the meccanicaadda.it scan, go to Web Security and work through one sub-tab at a time: HTTP Security, SSL/TLS Certificates, DNS Security and Cookie Analysis. For each one you see what RECON measures and which fix to make first.

Chapters

Key points

HTTP Security

• Security headers are instructions the server sends to the browser with every response. RECON checks seven of them: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy and Permissions-Policy.
• At the top you see Domains Analyzed, Avg. Coverage (the average share of headers present across all domains), Grade and Risk Level. The level is Low from 75% average coverage upwards, Medium from 50%, High from 25% and Critical below 25%.
• The radar chart shows the 0 to 100 score of each header for the selected domain; the Grade runs from A+ to F and is the average of the seven scores.
• Header Details lists the seven checks, one per row, marked Active or Missing. Use the menu to switch domain: every Missing row is a change to make in the web server configuration.

SSL/TLS certificates

• The table shows Grade, Hostname, Version, Expiry and HSTS for each host.
• The grade takes into account the TLS version, cipher strength, certificate validity and HSTS, so a host still on TLS 1.2 scores lower than one on TLS 1.3.
• Expiry Warnings counts valid certificates that expire within 90 days.
• What to do: move hosts to TLS 1.3, enable HSTS where it is missing (No HSTS) and renew certificates before they expire.

DNS Security

• Four checks protect your domain from anyone sending email while pretending to be your company: SPF declares who may send on your behalf, DKIM signs messages, DMARC tells recipients what to do when verification fails, and DNSSEC signs the DNS zone against forged answers.
• The DNS Grade sums up the four checks; next to DMARC you see the published Policy. A none policy only monitors: move it step by step to quarantine and then to reject.
• Further down, DNS Records shows the values actually published.

Cookie Analysis

• For each cookie, check three attributes: Secure (the cookie is never sent in clear text), HttpOnly (page scripts cannot read it) and SameSite (limits when other sites can send the cookie).
• The summary shows Total Cookies and how many cookies lack the Secure flag. Open a domain to review its cookies row by row.

Transcript

The full transcript of the video (in Italian) is in the Transcript tab of the player.

Related articles