You find security glitches everywhere for protocols and not always best policies are being followened.
For instance where SQL attacks lure all code that is not code with prepared statements is insecure crap.
The idea behind prepared statements is defense against the root of the SQL injection problem is mixing of the code and the data. The idea is very simple - the query and the data are sent to the SQL server separately.
That's all. (info credits go to rtesh from stack-overflow.
In this case we see secure header policies with issues.
For this forum site you see now: HTTP security headers
Name Value Setting secure
access-control-allow-origin *
x-content-type-options Header not returned
x-xss-protection Header not returned
x-frame-options Header not returned
content-security-policy Header not returned
cache-control Header not returned
Page meta security headers Name Value Setting secure
content-security-policy N/A
cache-control N/A
IForm autocomplete settings Name Type Setting secure
_search_form
HTML form
search
Form element of type 'text', child of <form> '_search_form'
pmFolder
HTML form
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
I
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
Insecure Icon
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
Insecure Icon
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
pms[]
Form element of type 'checkbox', child of <form> 'pmFolder'
Security Headers for the HTTP content - Summary
Number of Happy Findings: 5
Number of Not As Happy Findings: 5
Percentage Happy Findings: 50%
X-Frame-Options
Good news! X-Frame-Options was found in this site's HTTP header so the site is safer from clickjacking attacks!
Strict-Transport-Security
Uh oh! Strict-Transport-Security does not appear to be found in the site's HTTP header, so browsers will not try to access your pages over SSL first.
Nosniff
Good news! nosniff was found in this site's HTTP header so IE is prevented from trying to sniff MIME types!
X-XSS-Protection
Good news! X-XSS-Protection: 1 was found in this site's HTTP header so if a cross-site scripting attack is detected, Internet Explorer 8 and 9 will attempt to make the smallest possible modification to the returned web page in order to block the attack!
Promiscuous CORS Support
Uh oh! Access-Control-Allow-Origin: * was found in forum.avast.com's HTTP headers so your server is allowing any site to request content from forum.avast.com, possibly making sensitive content available to others.
Content Security Policy
Uh oh! We did not detect Content-Security-Policy , x-webkit-csp, or even x-webkit-csp-report-only in the site's HTTP header, making XSS attacks more likely to succeed.
UTF-8 Character Encoding
Good news! utf-8 was found in this site's HTTP header, minimizing the likelihood that malicious character conversion could happen.
Server Information
Uh oh! Server: was found in this site's HTTP header, possibly making it easier for attackers to know about potential vulnerabilities that may exist on your site!
X-Powered-By
Good news! X-Powered-By was not found in this site's HTTP header, making it harder for attackers to know about potential vulnerabilities that may exist on your site!
Cross Domain Meta Policy
Uh oh! Permitted-Cross-Domain-Policies does not appear to be found in the site's HTTP header, so it's possible that cross domain policies can be set by other users on your site and be obeyed by Adobe Flash and pdf. files..
So security and security practices aren't optimal as you can see from the above results,
polonus
