{"history":[{"id":107056361,"scanned_at":"2026-07-12T03:36:47.118Z","grade":"D","score":30}],"scan":{"id":133322949,"algorithm_version":6,"scanned_at":"2026-11-03T14:09:51.462Z","error":null,"grade":"D","response_headers":{"age":"2480","nel":"{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}","date":"Tue, 03 Nov 2026 14:09:51 GMT","link":"; rel=preload; as=\"font\"; crossorigin=\"\"; type=\"font/woff2\", ; rel=preload; as=\"font\"; crossorigin=\"\"; type=\"font/woff2\", ; rel=preload; as=\"font\"; crossorigin=\"\"; type=\"font/woff2\", ; rel=preload; as=\"image\", ; rel=preload; as=\"image\"; fetchpriority=\"high\", ; rel=preload; as=\"image\", ; rel=preload; as=\"image\", ; rel=\"describedby\"; type=\"text/plain\"","vary":"rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept, Cookie, Authorization, accept-encoding","cf-ray":"a54bf5891f30a249-SJC","server":"cloudflare","alt-svc":"h3=\":443\"; ma=86400","report-to":"{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B8m4CKPaP9uByHDmuyu%2BPefiyZ4tGSd%2B%2FLHAA5o2z9ysU4Rf3m6oeydA2%2FjC4KfR9LNwsluSzW4P1qjAh09XJGEF%2BCei7xROiB2bEj5bEFBHXqxbuDdqY4KWED7UJa35Iy1kpr0E\"}]}","connection":"close","content-type":"text/html; charset=utf-8","cache-control":"public, s-maxage=3600","last-modified":"Tue, 03 Nov 2026 13:28:31 GMT","server-timing":"cfCacheStatus;desc=\"DYNAMIC\", cfEdge;dur=21,cfOrigin;dur=314","content-signal":"search=yes, ai-input=yes","x-edge-runtime":"1","x-matched-path":"/[locale]","cf-cache-status":"DYNAMIC","transfer-encoding":"chunked","x-public-html-cache":"HIT"},"score":30,"status_code":200,"tests_failed":4,"tests_passed":8,"tests_quantity":12},"tests":{"content-security-policy":{"expectation":"csp-implemented-with-no-unsafe","name":"content-security-policy","link":"/en-US/docs/Web/Security/Practical_implementation_guides/CSP","title":"Content Security Policy (CSP)","pass":false,"result":"csp-not-implemented","score_description":"

\n Content Security Policy (CSP) header not implemented\n

","recommendation":"

\n Implement one, see MDN's Content Security Policy (CSP) documentation.\n

","score_modifier":-25,"data":null,"http":false,"meta":false,"policy":null,"num_policies":0},"cookies":{"expectation":"cookies-secure-with-httponly-sessions","name":"cookies","link":"/en-US/docs/Web/Security/Practical_implementation_guides/Cookies","title":"Cookies","pass":null,"result":"cookies-not-found","score_description":"

\n No cookies detected\n

","recommendation":"","score_modifier":0,"data":null,"same_site":false},"cross-origin-embedder-policy":{"expectation":"coep-not-implemented","name":"cross-origin-embedder-policy","link":"/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy","title":"Cross Origin Embedder Policy","pass":true,"result":"coep-not-implemented","score_description":"

\n Cross-Origin-Embedder-Policy header not implemented.\n

","recommendation":"

\n Set to require-corp or credentialless.\n

","score_modifier":0,"data":null,"http":false},"cross-origin-opener-policy":{"expectation":"coop-not-implemented","name":"cross-origin-opener-policy","link":"/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy","title":"Cross Origin Opener Policy","pass":true,"result":"coop-not-implemented","score_description":"

\n Cross-Origin-Opener-Policy header not implemented.\n

","recommendation":"

\n Set to same-origin, same-origin-allow-popups, or noopener-allow-popups.\n

","score_modifier":0,"data":null,"http":false},"cross-origin-resource-sharing":{"expectation":"cross-origin-resource-sharing-not-implemented","name":"cross-origin-resource-sharing","link":"/en-US/docs/Web/Security/Practical_implementation_guides/CORS","title":"Cross Origin Resource Sharing (CORS)","pass":true,"result":"cross-origin-resource-sharing-not-implemented","score_description":"

\n Content is not visible via cross-origin resource sharing (CORS) files or headers.\n

","recommendation":"","score_modifier":0,"data":null},"redirection":{"expectation":"redirection-to-https","name":"redirection","link":"/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_redirection","title":"Redirection","pass":true,"result":"redirection-to-https","score_description":"

\n Initial redirection is to HTTPS on same host, final destination is HTTPS\n

","recommendation":"","score_modifier":0,"route":["http://facialharmonyai.com/","https://facialharmonyai.com/"],"redirects":true,"status_code":200,"destination":"https://facialharmonyai.com/"},"referrer-policy":{"expectation":"referrer-policy-private","name":"referrer-policy","link":"/en-US/docs/Web/Security/Practical_implementation_guides/Referrer_policy","title":"Referrer Policy","pass":null,"result":"referrer-policy-not-implemented","score_description":"

\n Referrer-Policy header not implemented.\n

","recommendation":"

\n Set to strict-origin-when-cross-origin at a minimum.\n

","score_modifier":0,"data":null,"http":false,"meta":false},"strict-transport-security":{"expectation":"hsts-implemented-max-age-at-least-six-months","name":"strict-transport-security","link":"/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation","title":"Strict Transport Security (HSTS)","pass":false,"result":"hsts-not-implemented","score_description":"

\n Strict-Transport-Security header not implemented.\n

","recommendation":"

\n Add HSTS. Consider rolling out with shorter periods first (as suggested on https://hstspreload.org/).\n

","score_modifier":-20,"data":null,"max_age":null,"preload":false,"preloaded":false,"include_sub_domains":false},"subresource-integrity":{"expectation":"sri-implemented-and-external-scripts-loaded-securely","name":"subresource-integrity","link":"/en-US/docs/Web/Security/Subresource_Integrity","title":"Subresource Integrity","pass":true,"result":"sri-implemented-and-external-scripts-loaded-securely","score_description":"

\n Subresource Integrity (SRI) is implemented and all scripts are loaded securely.\n

","recommendation":"","score_modifier":5,"data":{"https://static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092":{"integrity":"sha512-UKNk8GbxkABxKcXYuLkO16EleLGUkcvJWtpSNmExE0Too3ZaFAxTscNWEc1OdAv5/BikHawapSCaiD2XCmp+Bw==","crossorigin":"anonymous"}}},"x-content-type-options":{"expectation":"x-content-type-options-nosniff","name":"x-content-type-options","link":"/en-US/docs/Web/Security/Practical_implementation_guides/MIME_types","title":"X-Content-Type-Options","pass":false,"result":"x-content-type-options-not-implemented","score_description":"

\n X-Content-Type-Options header not implemented.\n

","recommendation":"

\n Set to nosniff.\n

","score_modifier":-5,"data":null},"x-frame-options":{"expectation":"x-frame-options-sameorigin-or-deny","name":"x-frame-options","link":"/en-US/docs/Web/Security/Attacks/Clickjacking","title":"X-Frame-Options","pass":false,"result":"x-frame-options-not-implemented","score_description":"

\n X-Frame-Options (XFO) header not implemented.\n

","recommendation":"

\n Implement frame-ancestors CSP.\n

","score_modifier":-20,"data":null},"cross-origin-resource-policy":{"expectation":"corp-implemented-with-same-site","name":"cross-origin-resource-policy","link":"/en-US/docs/Web/Security/Practical_implementation_guides/CORP","title":"Cross Origin Resource Policy","pass":null,"result":"corp-not-implemented","score_description":"

\n Cross Origin Resource Policy (CORP) is not implemented (defaults to cross-origin).\n

","recommendation":"","score_modifier":0,"data":null,"http":false,"meta":false}}}