thechampionofthethames.com

# Passive security review — Champion Of The Thames

Run: 445683b5-0f64-4547-a112-b12f45c95a40  
Status: **partial**  
Reviewed: `thechampionofthethames.com`, `www.thechampionofthethames.com`  
Started: 2026-10-26T20:19:00.809Z  
Requests: 17 of 40 budgeted, at most 1/s  
Discovered pages: 3
Tier: 2 (limited writes) — +2 parameter surface, +2 cart/checkout logic, +1 version disclosure, +1 no WAF observed

## Summary

**8** configuration issues: 0 high, 5 medium, 3 low.

### Pages fetched

- https://thechampionofthethames.com/contact-us → HTTP 200
- https://thechampionofthethames.com/ → HTTP 200
- https://thechampionofthethames.com/download-pub-quizzes → HTTP 302

## Checks

| Check | Host | Severity | Result |
| --- | --- | --- | --- |
| The site serves HTTPS | thechampionofthethames.com, www.thechampionofthethames.com | Info | pass |
| HTTP Strict Transport Security | thechampionofthethames.com, www.thechampionofthethames.com | Medium | fail |
| Content Security Policy | thechampionofthethames.com, www.thechampionofthethames.com | Medium | fail |
| MIME type sniffing is disabled | thechampionofthethames.com, www.thechampionofthethames.com | Low | fail |
| Framing is restricted | thechampionofthethames.com, www.thechampionofthethames.com | Medium | fail |
| Referrer policy | thechampionofthethames.com, www.thechampionofthethames.com | Low | fail |
| Cookie attributes | thechampionofthethames.com, www.thechampionofthethames.com | Medium | fail |
| Server version disclosure | thechampionofthethames.com, www.thechampionofthethames.com | Low | fail |
| Cross-origin resource sharing | thechampionofthethames.com, www.thechampionofthethames.com | Info | pass |
| HTTP redirects to HTTPS | thechampionofthethames.com, www.thechampionofthethames.com | Medium | fail |
| Git metadata is not exposed | thechampionofthethames.com, www.thechampionofthethames.com | Info | pass |
| Environment file is not exposed | thechampionofthethames.com, www.thechampionofthethames.com | Info | pass |
| Server status page is not exposed | thechampionofthethames.com, www.thechampionofthethames.com | Info | pass |
| security.txt | thechampionofthethames.com, www.thechampionofthethames.com | Low | info |
| TLS certificate | thechampionofthethames.com, www.thechampionofthethames.com | Info | pass |

## Findings

### 1. HTTP Strict Transport Security (Medium)

No Strict-Transport-Security header was returned.

**Suggested fix.** Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Start with a short max-age while testing.

### 2. Content Security Policy (Medium)

No Content-Security-Policy header was returned.

**Suggested fix.** Start with Content-Security-Policy-Report-Only. Inventory external scripts and inline code, then test a site-specific policy before enforcing it.

### 3. Framing is restricted (Medium)

Neither X-Frame-Options nor a CSP frame-ancestors directive restricts framing.

**Suggested fix.** Send X-Frame-Options: SAMEORIGIN or a CSP frame-ancestors directive.

### 4. Cookie attributes (Medium)

Cookies [dps_site_id] are missing HttpOnly.

**Suggested fix.** Set Secure, HttpOnly and SameSite on every session cookie.

### 5. HTTP redirects to HTTPS (Medium)

A plain HTTP request returned 301 to http://thechampionofthethames.com/ instead of an HTTPS redirect.

**Suggested fix.** Redirect every HTTP request to the HTTPS origin with a 301 or 308.

### 6. MIME type sniffing is disabled (Low)

No X-Content-Type-Options header was returned.

**Suggested fix.** Add X-Content-Type-Options: nosniff.

### 7. Referrer policy (Low)

No Referrer-Policy header was returned.

**Suggested fix.** Add Referrer-Policy: strict-origin-when-cross-origin.

### 8. Server version disclosure (Low)

The response discloses component versions: DPS/2.0.0+sha-4384650.

**Suggested fix.** Remove version numbers from Server and X-Powered-By responses.

## Patch

Configuration suggestions for staging review; see `patch/README.md` for placement and verification.

### _headers

```
# Review in staging. CSP is report-only and does not remediate the CSP finding.
/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Content-Security-Policy-Report-Only: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; script-src 'self'
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: strict-origin-when-cross-origin
```

### nginx.conf

```
# Review in staging. CSP is report-only; tailor it before enforcement.
# Add inside the server { } block, then reload nginx.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; script-src 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Add inside the server { } block.
server_tokens off;
```

### apache.conf

```
# Review in staging. CSP is report-only; tailor it before enforcement.
# Add inside the <VirtualHost> block or .htaccess, then reload Apache.
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; script-src 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Add inside the <VirtualHost> block or .htaccess.
ServerTokens Prod
```

## Requires site-specific review

- csp
- cookies
- http-redirect

## Application findings (deep pass)

The deep pass did not finish (failed); app coverage is incomplete.
## Basis and limits

The baseline is passive: GET and HEAD against public addresses only. DNS is resolved once and connections are pinned; the site stays inside its own registrable domain; redirects are reported, never followed; the rate and request budget are enforced.

Checks cover transport, response headers, cookie flags, version banners, CORS, the certificate, and a few well-known exposure paths.

## What this review did not do

No exploitation, login, form submission, credential use, file upload, or application-logic testing in the passive baseline. No finding is confirmed exploitable; exposures are recorded as directly observed. Nothing was changed on the server.

## Delivery

`owner-email.md` and `github-issue.md` are generated from these findings. Nothing is sent unless the `send` command runs.