gailsbread.co.uk

# Passive security review — gailsbread.co.uk

Run: df6b397f-2161-4000-a9f4-7d5823f8d7ac  
Status: **completed**  
Reviewed: `gailsbread.co.uk`, `www.gailsbread.co.uk`  
Started: 2026-10-26T15:59:56.542Z  
Requests: 12 of 40 budgeted, at most 1/s  
Discovered pages: 0
Tier: 1

## Summary

**2** configuration issues: 0 high, 1 medium, 1 low.

## Checks

| Check | Host | Severity | Result |
| --- | --- | --- | --- |
| The site serves HTTPS | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |
| HTTP Strict Transport Security | gailsbread.co.uk, www.gailsbread.co.uk | Medium | fail |
| Content Security Policy | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |
| MIME type sniffing is disabled | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |
| Framing is restricted | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |
| Referrer policy | gailsbread.co.uk, www.gailsbread.co.uk | Low | fail |
| Cookie attributes | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |
| Server version disclosure | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |
| Cross-origin resource sharing | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |
| HTTP redirects to HTTPS | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |
| Exposure check: /.git/HEAD | gailsbread.co.uk, www.gailsbread.co.uk | Info | info |
| Exposure check: /.env | gailsbread.co.uk, www.gailsbread.co.uk | Info | info |
| Exposure check: /server-status | gailsbread.co.uk, www.gailsbread.co.uk | Info | info |
| Exposure check: /.well-known/security.txt | gailsbread.co.uk, www.gailsbread.co.uk | Info | info |
| TLS certificate | gailsbread.co.uk, www.gailsbread.co.uk | Info | pass |

## Findings

### 1. HTTP Strict Transport Security (Medium)

Strict-Transport-Security max-age is 7889238; below the 180-day baseline.

**Suggested fix.** Raise max-age to at least 15552000 and add includeSubDomains once every subdomain supports HTTPS.

### 2. Referrer policy (Low)

No Referrer-Policy header was returned.

**Suggested fix.** Add Referrer-Policy: strict-origin-when-cross-origin.

## Patch

Configuration suggestions for staging review; see `patch/README.md` for placement and verification.

### _headers

```
# Review in staging. CSP is report-only and does not remediate the CSP finding.
/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Referrer-Policy: strict-origin-when-cross-origin
```

### nginx.conf

```
# Review in staging. CSP is report-only; tailor it before enforcement.
# Add inside the server { } block, then reload nginx.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
```

### apache.conf

```
# Review in staging. CSP is report-only; tailor it before enforcement.
# Add inside the <VirtualHost> block or .htaccess, then reload Apache.
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
```

## Application findings (deep pass)

The deep pass completed with no confirmed application findings. This does not establish complete coverage or prove the site is secure.
## Basis and limits

The baseline is passive: GET and HEAD against public addresses only. DNS is resolved once and connections are pinned; the site stays inside its own registrable domain; redirects are reported, never followed; the rate and request budget are enforced.

Checks cover transport, response headers, cookie flags, version banners, CORS, the certificate, and a few well-known exposure paths.

## What this review did not do

No exploitation, login, form submission, credential use, file upload, or application-logic testing in the passive baseline. No finding is confirmed exploitable; exposures are recorded as directly observed. Nothing was changed on the server.

## Delivery

`owner-email.md` and `github-issue.md` are generated from these findings. Nothing is sent unless the `send` command runs.