{"history":[{"id":128041615,"scanned_at":"2026-10-14T13:21:51.327Z","grade":"C","score":50},{"id":128217382,"scanned_at":"2026-10-15T06:35:35.243Z","grade":"C-","score":45},{"id":128243768,"scanned_at":"2026-10-15T09:11:02.152Z","grade":"C","score":50},{"id":129233667,"scanned_at":"2026-10-19T12:07:37.072Z","grade":"C-","score":45},{"id":130784168,"scanned_at":"2026-10-24T23:45:48.908Z","grade":"C","score":50},{"id":131649879,"scanned_at":"2026-10-28T04:56:20.623Z","grade":"C-","score":45}],"scan":{"id":132144031,"algorithm_version":6,"scanned_at":"2026-10-30T00:17:02.260Z","error":null,"grade":"C-","response_headers":{"nel":"{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}","date":"Fri, 30 Oct 2026 00:17:03 GMT","link":"; rel=\"alternate\"; hreflang=\"ja\", ; rel=\"alternate\"; hreflang=\"en\", ; rel=\"alternate\"; hreflang=\"zh\", ; rel=\"alternate\"; hreflang=\"x-default\", ; rel=\"describedby\"; type=\"text/plain\"","vary":"rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch","cf-ray":"a5263c15bf608ad4-LAX","server":"cloudflare","alt-svc":"h3=\":443\"; ma=86400","report-to":"{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sAyy7Al%2FoSwC8PxIxFDkXbV0mRk3ypB2m7TnUTTLebcyRqFTm8TdHfDw86qUCcRD4PzmWrxYSaioWqhmrOkHQxm8Eu%2Fw2O9H8UtWChjdrNYz9OMhJwIn%2Fl7yBR3SHqwGkPz0nwEs\"}]}","connection":"close","set-cookie":"NEXT_LOCALE=ja; Path=/; SameSite=lax","x-opennext":"1","content-type":"text/html; charset=utf-8","x-powered-by":"Next.js","cache-control":"private, no-cache, no-store, max-age=0, must-revalidate","server-timing":"cfEdge;dur=539,cfOrigin;dur=0,cfWorker;dur=981","content-signal":"search=yes, ai-input=yes","transfer-encoding":"chunked","x-public-html-cache":"MISS"},"score":45,"status_code":200,"tests_failed":4,"tests_passed":8,"tests_quantity":12},"tests":{"content-security-policy":{"expectation":"csp-implemented-with-no-unsafe","name":"content-security-policy","link":"/en-US/docs/Web/Security/Practical_implementation_guides/CSP","title":"Content Security Policy (CSP)","pass":false,"result":"csp-not-implemented","score_description":"

\n Content Security Policy (CSP) header not implemented\n

","recommendation":"

\n Implement one, see MDN's Content Security Policy (CSP) documentation.\n

","score_modifier":-25,"data":null,"http":false,"meta":false,"policy":null,"num_policies":0},"cookies":{"expectation":"cookies-secure-with-httponly-sessions","name":"cookies","link":"/en-US/docs/Web/Security/Practical_implementation_guides/Cookies","title":"Cookies","pass":false,"result":"cookies-without-secure-flag-but-protected-by-hsts","score_description":"

\n Cookies set without using the Secure flag, but transmission over HTTP prevented by HSTS.\n

","recommendation":"

\n Use Secure flag.\n

","score_modifier":-5,"data":{"NEXT_LOCALE":{"path":"/","port":null,"domain":"virtual-staging.app","samesite":"lax"}},"same_site":false},"cross-origin-embedder-policy":{"expectation":"coep-not-implemented","name":"cross-origin-embedder-policy","link":"/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy","title":"Cross Origin Embedder Policy","pass":true,"result":"coep-not-implemented","score_description":"

\n Cross-Origin-Embedder-Policy header not implemented.\n

","recommendation":"

\n Set to require-corp or credentialless.\n

","score_modifier":0,"data":null,"http":false},"cross-origin-opener-policy":{"expectation":"coop-not-implemented","name":"cross-origin-opener-policy","link":"/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy","title":"Cross Origin Opener Policy","pass":true,"result":"coop-not-implemented","score_description":"

\n Cross-Origin-Opener-Policy header not implemented.\n

","recommendation":"

\n Set to same-origin, same-origin-allow-popups, or noopener-allow-popups.\n

","score_modifier":0,"data":null,"http":false},"cross-origin-resource-sharing":{"expectation":"cross-origin-resource-sharing-not-implemented","name":"cross-origin-resource-sharing","link":"/en-US/docs/Web/Security/Practical_implementation_guides/CORS","title":"Cross Origin Resource Sharing (CORS)","pass":true,"result":"cross-origin-resource-sharing-not-implemented","score_description":"

\n Content is not visible via cross-origin resource sharing (CORS) files or headers.\n

","recommendation":"","score_modifier":0,"data":null},"redirection":{"expectation":"redirection-to-https","name":"redirection","link":"/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_redirection","title":"Redirection","pass":true,"result":"redirection-all-redirects-preloaded","score_description":"

\n All hosts redirected to are in the HTTP Strict Transport Security (HSTS) preload list.\n

","recommendation":"","score_modifier":0,"route":["http://virtual-staging.app/","https://virtual-staging.app/"],"redirects":true,"status_code":200,"destination":"https://virtual-staging.app/"},"referrer-policy":{"expectation":"referrer-policy-private","name":"referrer-policy","link":"/en-US/docs/Web/Security/Practical_implementation_guides/Referrer_policy","title":"Referrer Policy","pass":null,"result":"referrer-policy-not-implemented","score_description":"

\n Referrer-Policy header not implemented.\n

","recommendation":"

\n Set to strict-origin-when-cross-origin at a minimum.\n

","score_modifier":0,"data":null,"http":false,"meta":false},"strict-transport-security":{"expectation":"hsts-implemented-max-age-at-least-six-months","name":"strict-transport-security","link":"/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation","title":"Strict Transport Security (HSTS)","pass":true,"result":"hsts-preloaded","score_description":"

\n Preloaded via the HTTP Strict Transport Security (HSTS) preloading process.\n

","recommendation":"","score_modifier":5,"data":null,"max_age":null,"preload":false,"preloaded":true,"include_sub_domains":true},"subresource-integrity":{"expectation":"sri-implemented-and-external-scripts-loaded-securely","name":"subresource-integrity","link":"/en-US/docs/Web/Security/Subresource_Integrity","title":"Subresource Integrity","pass":true,"result":"sri-implemented-and-external-scripts-loaded-securely","score_description":"

\n Subresource Integrity (SRI) is implemented and all scripts are loaded securely.\n

","recommendation":"","score_modifier":5,"data":{"https://static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092":{"integrity":"sha512-UKNk8GbxkABxKcXYuLkO16EleLGUkcvJWtpSNmExE0Too3ZaFAxTscNWEc1OdAv5/BikHawapSCaiD2XCmp+Bw==","crossorigin":"anonymous"}}},"x-content-type-options":{"expectation":"x-content-type-options-nosniff","name":"x-content-type-options","link":"/en-US/docs/Web/Security/Practical_implementation_guides/MIME_types","title":"X-Content-Type-Options","pass":false,"result":"x-content-type-options-not-implemented","score_description":"

\n X-Content-Type-Options header not implemented.\n

","recommendation":"

\n Set to nosniff.\n

","score_modifier":-5,"data":null},"x-frame-options":{"expectation":"x-frame-options-sameorigin-or-deny","name":"x-frame-options","link":"/en-US/docs/Web/Security/Attacks/Clickjacking","title":"X-Frame-Options","pass":false,"result":"x-frame-options-not-implemented","score_description":"

\n X-Frame-Options (XFO) header not implemented.\n

","recommendation":"

\n Implement frame-ancestors CSP.\n

","score_modifier":-20,"data":null},"cross-origin-resource-policy":{"expectation":"corp-implemented-with-same-site","name":"cross-origin-resource-policy","link":"/en-US/docs/Web/Security/Practical_implementation_guides/CORP","title":"Cross Origin Resource Policy","pass":null,"result":"corp-not-implemented","score_description":"

\n Cross Origin Resource Policy (CORP) is not implemented (defaults to cross-origin).\n

","recommendation":"","score_modifier":0,"data":null,"http":false,"meta":false}}}