Target bluemonk.cc
10 out of 100
- Blast radius
- /100
- Grade
- A
Security headers missing. The perimeter is defended, but the gates are unlocked.
Damage assessment
- 01
Content Security Policy header is missing. Attackers can inject scripts with the same ease as legitimate ones.
How to fix this - 02
X-Frame-Options and frame-ancestors directives absent. The site can be embedded in a malicious frame without resistance.
How to fix this - 03
X-Content-Type-Options header missing. Browsers may guess MIME types and execute files as script.
How to fix this - 04
Permissions-Policy header not set. The site grants camera, microphone, and geolocation access by default.
How to fix this - 05
Referrer-Policy header missing. The site leaks query parameters and session tokens to third-party domains.
How to fix this - 06
Text contrast ratio insufficient in one or more regions. Some visitors will struggle to read the content.
Deploy Content Security Policy first. It blocks inline script injection and reduces the attack surface significantly. Add the remaining security headers afterward.
By category
- Performance
- 96
- SEO
- 100
- Accessibility
- 91
- Security
- 64
- Copy & clarity
- 100
Full report
Every finding, ranked, with fixes. $10.
All 7 findings with severity, evidence, why it matters and how to fix it, with WordPress-specific steps where they apply. Plus a checklist in the order to work through it.
$10, one-time, via Stripe. The private link is emailed to you.
Recovery
We can fix it for you
Tell us what you need. A person replies with a quote within one business day.
Share
Scanned Sat, 19 Sep 2026 13:26:21 GMT. Roast written by AI from the scan data. Passive scan: we only read public pages. Is this your site? Remove this roast.