Scan report

https://aimangatranslator.app/

Scanned 9/15/2026, 11:35:20 AM

80

/ 100

Overall readiness

Strong agentic-web readiness

Grade B

2 critical issues and 4 recommended fixes found.

Agent Readiness

100/100

SEO

100/100

Performance & Accessibility

99/100

Security

44/100

  • HTTPS — Pass, scored 100 of 100

    Evidence: Page served over HTTPS

    Spec: RFC 9110: HTTP Semantics

  • HSTS header — Fail, scored 0 of 100

    Evidence: No Strict-Transport-Security header

    Fix: Send an HSTS header to force HTTPS for returning visitors.

    Strict-Transport-Security: max-age=31536000; includeSubDomains

    Spec: RFC 6797: HTTP Strict Transport Security

  • Content-Security-Policy — Fail, scored 0 of 100

    Evidence: No Content-Security-Policy header

    Fix: Add a Content-Security-Policy to mitigate XSS and data-injection attacks.

    Content-Security-Policy: default-src 'self'; img-src 'self' data:; script-src 'self'

    Spec: Content Security Policy Level 3 (W3C)

  • X-Content-Type-Options — Fail, scored 0 of 100

    Evidence: No X-Content-Type-Options header

    Fix: Send X-Content-Type-Options: nosniff to stop MIME-type sniffing.

    X-Content-Type-Options: nosniff

    Spec: Fetch Standard: X-Content-Type-Options

  • Referrer-Policy — Fail, scored 0 of 100

    Evidence: No Referrer-Policy header

    Fix: Set a Referrer-Policy to control how much referrer information leaks.

    Referrer-Policy: strict-origin-when-cross-origin

    Spec: Referrer Policy (W3C)

  • No mixed content — Pass, scored 100 of 100

    Evidence: No insecure http:// resource references found

    Spec: Mixed Content (W3C)

  • Cookie security flags — Pass, scored 100 of 100

    Evidence: No Set-Cookie headers

    Spec: RFC 6265: HTTP State Management Mechanism

Critical issues

Fix these first

  • HSTS header

    security

    No Strict-Transport-Security header

  • Content-Security-Policy

    security

    No Content-Security-Policy header

Recommended fixes

Ranked by impact

  • HSTS headersecurityHigh impactLow effort

    Why: No Strict-Transport-Security header

    Fix: Send an HSTS header to force HTTPS for returning visitors.

    Strict-Transport-Security: max-age=31536000; includeSubDomains
  • Content-Security-PolicysecurityHigh impactMed effort

    Why: No Content-Security-Policy header

    Fix: Add a Content-Security-Policy to mitigate XSS and data-injection attacks.

    Content-Security-Policy: default-src 'self'; img-src 'self' data:; script-src 'self'
  • X-Content-Type-OptionssecurityMed impactLow effort

    Why: No X-Content-Type-Options header

    Fix: Send X-Content-Type-Options: nosniff to stop MIME-type sniffing.

    X-Content-Type-Options: nosniff
  • Referrer-PolicysecurityMed impactLow effort

    Why: No Referrer-Policy header

    Fix: Set a Referrer-Policy to control how much referrer information leaks.

    Referrer-Policy: strict-origin-when-cross-origin