Contents
About This Report
Report Description
Nici Hills - Operations Director <nici@netfm.org>
Full pen test for NetFM on production server
Report Parameters
Contexts
No contexts were selected, so all contexts were included by default.
Sites
The following sites were included:
- https://netfm.org
- https://firefox-settings-attachments.cdn.mozilla.net
- https://www.gstatic.com
- https://www.googletagmanager.com
- https://www.google.com
- https://unpkg.com
- https://visitor.express
(If no sites were selected, all sites were included by default.)
An included site must also be within one of the included contexts for its data to be included in the report.
Risk levels
Included: High, Medium, Low, Informational
Excluded: None
Confidence levels
Included: User Confirmed, High, Medium, Low
Excluded: User Confirmed, High, Medium, Low, False Positive
Summaries
Alert Counts by Risk and Confidence
| Confidence | ||||||
|---|---|---|---|---|---|---|
| User Confirmed | High | Medium | Low | Total | ||
| Risk | High | 0 (0.0%) |
0 (0.0%) |
0 (0.0%) |
0 (0.0%) |
0 (0.0%) |
| Medium | 0 (0.0%) |
2 (22.2%) |
0 (0.0%) |
0 (0.0%) |
2 (22.2%) |
|
| Low | 0 (0.0%) |
2 (22.2%) |
2 (22.2%) |
1 (11.1%) |
5 (55.6%) |
|
| Informational | 0 (0.0%) |
0 (0.0%) |
1 (11.1%) |
1 (11.1%) |
2 (22.2%) |
|
| Total | 0 (0.0%) |
4 (44.4%) |
3 (33.3%) |
2 (22.2%) |
9 (100%) |
|
Alert Counts by Site and Risk
| Risk | |||||
|---|---|---|---|---|---|
|
High (= High) |
Medium (>= Medium) |
Low (>= Low) |
Informational (>= Informational) |
||
| Site | https://netfm.org | 0 (0) |
2 (2) |
5 (7) |
2 (9) |
Alert Counts by Alert Type
| Alert type | Risk | Count |
|---|---|---|
| CSP: script-src unsafe-inline | Medium | 21 (233.3%) |
| CSP: style-src unsafe-inline | Medium | 21 (233.3%) |
| Cross-Domain JavaScript Source File Inclusion | Low | 44 (488.9%) |
| Server Leaks Version Information via "Server" HTTP Response Header Field | Low | 47 (522.2%) |
| Strict-Transport-Security Header Not Set | Low | 26 (288.9%) |
| Timestamp Disclosure - Unix | Low | 20 (222.2%) |
| X-Content-Type-Options Header Missing | Low | 26 (288.9%) |
| Information Disclosure - Sensitive Information in URL | Informational | 1 (11.1%) |
| Re-examine Cache-control Directives | Informational | 21 (233.3%) |
| Total | 9 |
Alerts
-
Risk=Medium, Confidence=High (2)
-
https://netfm.org (2)
-
CSP: script-src unsafe-inline (1)
GET https://netfm.org/contact/support.html
Alert tags Alert description Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
Other info script-src includes unsafe-inline.
Request Request line and header section (269 bytes)
GET https://netfm.org/contact/support.html HTTP/1.1 host: netfm.org user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: https://netfm.org/Request body (0 bytes)
Response Status line and header section (1023 bytes)
HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sun, 26 Oct 2025 19:24:43 GMT Content-Type: text/html Content-Length: 5087 Last-Modified: Sun, 26 Oct 2025 19:23:39 GMT Connection: keep-alive ETag: "68fe753b-13df" Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com https://www.gstatic.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self' https://api.netfm.org https://recaptchaenterprise.googleapis.com https://www.google.com; frame-src 'self' https://www.google.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; Accept-Ranges: bytesResponse body (5087 bytes)
<!DOCTYPE html> <html lang="en" class="h-full antialiased"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Support - NetFM</title> <script src="https://cdn.tailwindcss.com"></script> <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js" ></script> </head> <body class="h-full bg-white"> <header class="bg-black text-white sticky top-0 z-50"> <nav class="container mx-auto px-4 py-4 flex items-center justify-between"> <a href="/" class="text-2xl font-bold hover:text-gray-300">NetFM</a> <div class="hidden md:flex gap-4"> <a href="/#products" class="hover:text-gray-300 px-4 py-2">Products</a> <a href="/#features" class="hover:text-gray-300 px-4 py-2">Features</a> <a href="/#testimonials" class="hover:text-gray-300 px-4 py-2">Testimonials</a> <a href="/#faq" class="hover:text-gray-300 px-4 py-2">FAQ</a> <a href="/#celebrate" class="hover:text-gray-300 px-4 py-2">Celebrating 20 Years</a> </div> <a href="/contact.html" class="bg-white text-black px-6 py-2 rounded-full hover:bg-gray-200 transition">Contact us →</a> </nav> </header> <main class="min-h-screen py-20"> <div class="container mx-auto px-4 max-w-4xl"> <h1 class="text-5xl font-bold mb-8 text-gray-900">Support at NetFM</h1> <div class="prose prose-lg max-w-none"> <p class="text-lg text-gray-700"> Current customers will have direct access to our business messaging platform, with dedicated Discord and WhatsApp groups for their product. If you are unsure who / where to ask - then please email <a href="mailto:support@netfm.org" class="text-blue-600 hover:underline">support@netfm.org</a> and we will promptly redirect your request to the appropriate channel. </p> </div> </div> </main> <footer class="bg-gray-900 text-white py-12 border-t border-gray-800"> <div class="container mx-auto px-4"> <div class="grid grid-cols-2 md:grid-cols-5 gap-8 mb-8"> <div> <h3 class="text-sm font-semibold mb-4 text-white">Company</h3> <ul class="space-y-2"> <li><a href="/company/about.html" class="text-gray-400 hover:text-white text-sm">About</a></li> <li><a href="/public/pdf/Modern-Slavery_and_Human_Trafficking_Statement-signed.pdf" class="text-gray-400 hover:text-white text-sm" target="_blank">Slavery Statement</a></li> <li><a href="/company/news-articles.html" class="text-gray-400 hover:text-white text-sm">News Articles</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Contact</h3> <ul class="space-y-2"> <li><a href="/contact.html" class="text-gray-400 hover:text-white text-sm">Contact Us</a></li> <li><a href="/contact/careers.html" class="text-gray-400 hover:text-white text-sm">Careers</a></li> <li><a href="/contact/support.html" class="text-gray-400 hover:text-white text-sm">Support</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Marketing</h3> <ul class="space-y-2"> <li><a href="/marketing/brochures.html" class="text-gray-400 hover:text-white text-sm">Brochures</a></li> <li><a href="/marketing/brand-design.html" class="text-gray-400 hover:text-white text-sm">Brand design</a></li> <li><a href="/marketing/architecture.html" class="text-gray-400 hover:text-white text-sm">Architecture</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Developers</h3> <ul class="space-y-2"> <li><a href="/developers/roadmap.html" class="text-gray-400 hover:text-white text-sm">Roadmap</a></li> <li><a href="/developers/stack.html" class="text-gray-400 hover:text-white text-sm">Stack</a></li> <li><a href="/developers/api-documentation.html" class="text-gray-400 hover:text-white text-sm">API Documentation</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Legal</h3> <ul class="space-y-2"> <li><a href="/public/pdf/NetFM_Terms_And_Conditions.pdf" class="text-gray-400 hover:text-white text-sm" target="_blank">Terms and Conditions</a></li> <li><a href="/legal/privacy.html" class="text-gray-400 hover:text-white text-sm">Privacy</a></li> <li><a href="/legal/gdpr.html" class="text-gray-400 hover:text-white text-sm">GDPR</a></li> </ul> </div> </div> <div class="border-t border-gray-800 pt-8"> <p class="text-gray-400 text-sm text-center">Copyright NetFM UK Limited © 2025. All rights reserved.</p> </div> </div> </footer> </body> </html>Parameter Content-Security-PolicyEvidence default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com https://www.gstatic.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self' https://api.netfm.org https://recaptchaenterprise.googleapis.com https://www.google.com; frame-src 'self' https://www.google.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content;Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
-
CSP: style-src unsafe-inline (1)
GET https://netfm.org/contact/support.html
Alert tags Alert description Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
Other info style-src includes unsafe-inline.
Request Request line and header section (269 bytes)
GET https://netfm.org/contact/support.html HTTP/1.1 host: netfm.org user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: https://netfm.org/Request body (0 bytes)
Response Status line and header section (1023 bytes)
HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sun, 26 Oct 2025 19:24:43 GMT Content-Type: text/html Content-Length: 5087 Last-Modified: Sun, 26 Oct 2025 19:23:39 GMT Connection: keep-alive ETag: "68fe753b-13df" Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com https://www.gstatic.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self' https://api.netfm.org https://recaptchaenterprise.googleapis.com https://www.google.com; frame-src 'self' https://www.google.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; Accept-Ranges: bytesResponse body (5087 bytes)
<!DOCTYPE html> <html lang="en" class="h-full antialiased"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Support - NetFM</title> <script src="https://cdn.tailwindcss.com"></script> <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js" ></script> </head> <body class="h-full bg-white"> <header class="bg-black text-white sticky top-0 z-50"> <nav class="container mx-auto px-4 py-4 flex items-center justify-between"> <a href="/" class="text-2xl font-bold hover:text-gray-300">NetFM</a> <div class="hidden md:flex gap-4"> <a href="/#products" class="hover:text-gray-300 px-4 py-2">Products</a> <a href="/#features" class="hover:text-gray-300 px-4 py-2">Features</a> <a href="/#testimonials" class="hover:text-gray-300 px-4 py-2">Testimonials</a> <a href="/#faq" class="hover:text-gray-300 px-4 py-2">FAQ</a> <a href="/#celebrate" class="hover:text-gray-300 px-4 py-2">Celebrating 20 Years</a> </div> <a href="/contact.html" class="bg-white text-black px-6 py-2 rounded-full hover:bg-gray-200 transition">Contact us →</a> </nav> </header> <main class="min-h-screen py-20"> <div class="container mx-auto px-4 max-w-4xl"> <h1 class="text-5xl font-bold mb-8 text-gray-900">Support at NetFM</h1> <div class="prose prose-lg max-w-none"> <p class="text-lg text-gray-700"> Current customers will have direct access to our business messaging platform, with dedicated Discord and WhatsApp groups for their product. If you are unsure who / where to ask - then please email <a href="mailto:support@netfm.org" class="text-blue-600 hover:underline">support@netfm.org</a> and we will promptly redirect your request to the appropriate channel. </p> </div> </div> </main> <footer class="bg-gray-900 text-white py-12 border-t border-gray-800"> <div class="container mx-auto px-4"> <div class="grid grid-cols-2 md:grid-cols-5 gap-8 mb-8"> <div> <h3 class="text-sm font-semibold mb-4 text-white">Company</h3> <ul class="space-y-2"> <li><a href="/company/about.html" class="text-gray-400 hover:text-white text-sm">About</a></li> <li><a href="/public/pdf/Modern-Slavery_and_Human_Trafficking_Statement-signed.pdf" class="text-gray-400 hover:text-white text-sm" target="_blank">Slavery Statement</a></li> <li><a href="/company/news-articles.html" class="text-gray-400 hover:text-white text-sm">News Articles</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Contact</h3> <ul class="space-y-2"> <li><a href="/contact.html" class="text-gray-400 hover:text-white text-sm">Contact Us</a></li> <li><a href="/contact/careers.html" class="text-gray-400 hover:text-white text-sm">Careers</a></li> <li><a href="/contact/support.html" class="text-gray-400 hover:text-white text-sm">Support</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Marketing</h3> <ul class="space-y-2"> <li><a href="/marketing/brochures.html" class="text-gray-400 hover:text-white text-sm">Brochures</a></li> <li><a href="/marketing/brand-design.html" class="text-gray-400 hover:text-white text-sm">Brand design</a></li> <li><a href="/marketing/architecture.html" class="text-gray-400 hover:text-white text-sm">Architecture</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Developers</h3> <ul class="space-y-2"> <li><a href="/developers/roadmap.html" class="text-gray-400 hover:text-white text-sm">Roadmap</a></li> <li><a href="/developers/stack.html" class="text-gray-400 hover:text-white text-sm">Stack</a></li> <li><a href="/developers/api-documentation.html" class="text-gray-400 hover:text-white text-sm">API Documentation</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Legal</h3> <ul class="space-y-2"> <li><a href="/public/pdf/NetFM_Terms_And_Conditions.pdf" class="text-gray-400 hover:text-white text-sm" target="_blank">Terms and Conditions</a></li> <li><a href="/legal/privacy.html" class="text-gray-400 hover:text-white text-sm">Privacy</a></li> <li><a href="/legal/gdpr.html" class="text-gray-400 hover:text-white text-sm">GDPR</a></li> </ul> </div> </div> <div class="border-t border-gray-800 pt-8"> <p class="text-gray-400 text-sm text-center">Copyright NetFM UK Limited © 2025. All rights reserved.</p> </div> </div> </footer> </body> </html>Parameter Content-Security-PolicyEvidence default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com https://www.gstatic.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self' https://api.netfm.org https://recaptchaenterprise.googleapis.com https://www.google.com; frame-src 'self' https://www.google.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content;Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
-
-
-
Risk=Low, Confidence=High (2)
-
https://netfm.org (2)
-
Server Leaks Version Information via "Server" HTTP Response Header Field (1)
GET https://netfm.org/contact/support.html
Alert tags Alert description The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
Request Request line and header section (269 bytes)
GET https://netfm.org/contact/support.html HTTP/1.1 host: netfm.org user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: https://netfm.org/Request body (0 bytes)
Response Status line and header section (1023 bytes)
HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sun, 26 Oct 2025 19:24:43 GMT Content-Type: text/html Content-Length: 5087 Last-Modified: Sun, 26 Oct 2025 19:23:39 GMT Connection: keep-alive ETag: "68fe753b-13df" Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com https://www.gstatic.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self' https://api.netfm.org https://recaptchaenterprise.googleapis.com https://www.google.com; frame-src 'self' https://www.google.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; Accept-Ranges: bytesResponse body (5087 bytes)
<!DOCTYPE html> <html lang="en" class="h-full antialiased"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Support - NetFM</title> <script src="https://cdn.tailwindcss.com"></script> <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js" ></script> </head> <body class="h-full bg-white"> <header class="bg-black text-white sticky top-0 z-50"> <nav class="container mx-auto px-4 py-4 flex items-center justify-between"> <a href="/" class="text-2xl font-bold hover:text-gray-300">NetFM</a> <div class="hidden md:flex gap-4"> <a href="/#products" class="hover:text-gray-300 px-4 py-2">Products</a> <a href="/#features" class="hover:text-gray-300 px-4 py-2">Features</a> <a href="/#testimonials" class="hover:text-gray-300 px-4 py-2">Testimonials</a> <a href="/#faq" class="hover:text-gray-300 px-4 py-2">FAQ</a> <a href="/#celebrate" class="hover:text-gray-300 px-4 py-2">Celebrating 20 Years</a> </div> <a href="/contact.html" class="bg-white text-black px-6 py-2 rounded-full hover:bg-gray-200 transition">Contact us →</a> </nav> </header> <main class="min-h-screen py-20"> <div class="container mx-auto px-4 max-w-4xl"> <h1 class="text-5xl font-bold mb-8 text-gray-900">Support at NetFM</h1> <div class="prose prose-lg max-w-none"> <p class="text-lg text-gray-700"> Current customers will have direct access to our business messaging platform, with dedicated Discord and WhatsApp groups for their product. If you are unsure who / where to ask - then please email <a href="mailto:support@netfm.org" class="text-blue-600 hover:underline">support@netfm.org</a> and we will promptly redirect your request to the appropriate channel. </p> </div> </div> </main> <footer class="bg-gray-900 text-white py-12 border-t border-gray-800"> <div class="container mx-auto px-4"> <div class="grid grid-cols-2 md:grid-cols-5 gap-8 mb-8"> <div> <h3 class="text-sm font-semibold mb-4 text-white">Company</h3> <ul class="space-y-2"> <li><a href="/company/about.html" class="text-gray-400 hover:text-white text-sm">About</a></li> <li><a href="/public/pdf/Modern-Slavery_and_Human_Trafficking_Statement-signed.pdf" class="text-gray-400 hover:text-white text-sm" target="_blank">Slavery Statement</a></li> <li><a href="/company/news-articles.html" class="text-gray-400 hover:text-white text-sm">News Articles</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Contact</h3> <ul class="space-y-2"> <li><a href="/contact.html" class="text-gray-400 hover:text-white text-sm">Contact Us</a></li> <li><a href="/contact/careers.html" class="text-gray-400 hover:text-white text-sm">Careers</a></li> <li><a href="/contact/support.html" class="text-gray-400 hover:text-white text-sm">Support</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Marketing</h3> <ul class="space-y-2"> <li><a href="/marketing/brochures.html" class="text-gray-400 hover:text-white text-sm">Brochures</a></li> <li><a href="/marketing/brand-design.html" class="text-gray-400 hover:text-white text-sm">Brand design</a></li> <li><a href="/marketing/architecture.html" class="text-gray-400 hover:text-white text-sm">Architecture</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Developers</h3> <ul class="space-y-2"> <li><a href="/developers/roadmap.html" class="text-gray-400 hover:text-white text-sm">Roadmap</a></li> <li><a href="/developers/stack.html" class="text-gray-400 hover:text-white text-sm">Stack</a></li> <li><a href="/developers/api-documentation.html" class="text-gray-400 hover:text-white text-sm">API Documentation</a></li> </ul> </div> <div> <h3 class="text-sm font-semibold mb-4 text-white">Legal</h3> <ul class="space-y-2"> <li><a href="/public/pdf/NetFM_Terms_And_Conditions.pdf" class="text-gray-400 hover:text-white text-sm" target="_blank">Terms and Conditions</a></li> <li><a href="/legal/privacy.html" class="text-gray-400 hover:text-white text-sm">Privacy</a></li> <li><a href="/legal/gdpr.html" class="text-gray-400 hover:text-white text-sm">GDPR</a></li> </ul> </div> </div> <div class="border-t border-gray-800 pt-8"> <p class="text-gray-400 text-sm text-center">Copyright NetFM UK Limited © 2025. All rights reserved.</p> </div> </div> </footer> </body> </html>Evidence nginx/1.24.0 (Ubuntu)Solution Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.
-
Strict-Transport-Security Header Not Set (1)
GET https://netfm.org/public/logos/camc.png
Alert tags Alert description HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.
Request Request line and header section (270 bytes)
GET https://netfm.org/public/logos/camc.png HTTP/1.1 host: netfm.org user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: https://netfm.org/Request body (0 bytes)
Response Status line and header section (357 bytes)
HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sun, 26 Oct 2025 19:24:44 GMT Content-Type: image/png Content-Length: 22922 Last-Modified: Sun, 26 Oct 2025 13:25:35 GMT Connection: keep-alive ETag: "68fe214f-598a" Expires: Mon, 26 Oct 2026 19:24:44 GMT Cache-Control: max-age=31536000 Cache-Control: public, immutable Accept-Ranges: bytesResponse body (22922 bytes)
PNG IHDR D0`P pHYs à ÃÇo¨d tEXtSoftware www.inkscape.orgî< IDATxì½y|TÕýÿÿz;MÌ@fUDŶÖ~ZºãòiëÆ¢$°jÕZmkt·nu (;Ô*îÕº´ÚjÝ QL!°Ë{Þ¿?&`2÷Ü{ï,ß÷>jsÏ=ËÌ{ïûó~¿ÞÄÌpqqqqqqq)bÀÅÅÅÅÅÅåÿ\ÃÃÅÅÅÅÅÅ¥`¸KÁp á.......Ã5<\\\\\\\ kx¸¸¸¸¸¸¸×ðpqqqqqq)®ááââââââR0\ÃÃÅÅÅÅÅÅ¥`¸KÁp á.......Ã5<\\\\\\\ kx¸¸¸¸¸¸¸×ðpqqqqqq)®ááââââââR0<û{ ÝyqøÈêx¨W÷Ý]ôÎi±¥»ö÷Ø2ñÉ%Röî9!F3£/6H¹DïëyçØHóîý=>Þ 1ó~ë|ѨQý½íú9ÄtOhâ´]L4?ÞA3'4-ßRðAfà½K=¨DóþÀå ú*Né à]þÐå¢cm[]à!º¸¸¸¸¸ô nx¼}ÒIíMçùbÎÐÇbÕ&!èÌsV}úi>Çg%S+$ù5 ÕVëðôz9¯©×R......ù¤`Ç¢êê²béÆÀ +´jýØñÞÓÁ9 ¹ÒQô>À9l¢ÇHàÞ£æÇ>ÉéàòLoØh!äé`| *ËØ À20½-AÏÍm]Û>©ùöþM=õ-Y¡ÓÊ 88Ý9÷ìÐ4Úæo]³i&³Ì¶ÏLÌ"ë+ªÆv?æõbí[Ô¯ñC|HêqO§ÍÞÔäøÞ©ÉÔã¬ÉyMÖèß04}ßýO ¡×·5,q:¦½¤^GAÏ"ÍÙoqÖzrû¼¶¦®\®©¤-scѬÛíöù×ohü³|)~°,IH=.(ÑinÞdVÏʽèØJ²½íþ¶¶ÙÑeÿwEÕÕe^YtS¼ÓÙúê>=®Ýà¹[6kÞ³0: 5,1méäg¥_}¬eEÎc&ùýýúPñ`!ì{4õxFvý â ð}áàÚÍæ5ë²é_$<Ï×íP¢fÈÐÜõë×gÓ®&<wBò9éOÒ!lðvýÁñrBxy¨eÕÆlú6£Ù7t¼´¸û1½³Ì°R_09©Ç¥Gûo9Óå!? úÞ¢°dxBÒÙÝÁqs74~èd\{1^GïG:káòåÙ´+$}`<èyÀ¹Ù´kYDá«ú$ ívxÝD¢aõlÚNý|a_Õ ü<6©(ñ!éyÃqx êÍêY¹u }ö÷±Àz£ä ÏÛ÷¬ZÕ͸] GÞ¢Z^óé·xø³¤w ¯CöFG¿GVä¤-¼}y¨ÉQsð÷ ÆËNñÍ_1µÜ£vsF]yè>\²L·Ø¨êã2ÒgdÓMyÕÿ §Ñ ¡{j³i× DÛ¼oªõ~¦q©/â¬!« v6¸Oç£ T«#Ç×v2&]ð4À`t gïo^Ýd¥iåCG 83õ¸TçdL8¥tÓÎù³øÈ½_ð@£ ªñÇçº/ý,ìý8×íZîÞ:%  DüjÇøºpEèË÷Ë~%/7åâaGÓÞ/þ)À¿BòaKððé9nÓþ±Hn-ä LSâR¬X6Ù? DãömCDTW¸¿Óí±Cñ" FÝÕÕÕÅÎ^h|^Îåj+G8YQÔÅúeVÚHn1ð#ÊBÁÛÓ,"ÁÀª2)õ{¶£ ÏUP?s.6t¨ak(\¼¡<ðÇ<´[P¬üýKàÊ<õxG¸"0!?m§é2-r0ÏDþE]y(«Kþɩᱨººì¹á#Ñó°73¶ `¯¶@Êcó¥Ì]zïÍeÙo/ûYDZ_ÕÌôG ÚþÇôAC+pIqYçÄ÷: #ßëü²Ó°ábq5 µÑÉA R]ÊûüQ®¬TE_²Á8@PQ´dnÛºÿ³ÒÆe x²IqO§6ÅÎ,C¸!ì^¶@¸2xL¶Çü½peèð<t+ÀôX/pjÚ6 @¹p8,gÁ/ ýÁßN$ÚoÏ-ôäÌðx®ú¤÷còþ"`Æ~Ýj! ÿÛ!YK|üÉä ÃÒt!höè§5Ư@¸ßô=¹îñ\å ÎǬoÃñ+# L hr?ôÍl;|IS¨ó¿k¥ymM«AxMQt0%<ØSXuî±Ú¦µ_Àt 3ò¶-B¸-\23zz7é¶=:¦ç©ç"&úËôòàØÌ§æ2Ùj!àC>á$×ã ~q/xG®Çè²w.%¢çþ+ýó~ÝÇãÜo1H_\:É7kÌ£m¿AB¾P'¥9åù³[ßQÖ?døÁ(֯㧠oC\7th6-Ý9®i~ä´»çÄ NpµþÀx=ãõ'¾À»Ùt*;Q _Ús3 ¼m¥=f¾@egT`6j"à9KQ´©¯'ñ6jËÓMÖqö2¼¥,xW´ióܺòPë¶|´¦ûGȰåÁS¯(;üæ7®Ü!$^^úÖìhÚïXezÌE{øwM J<í8ZÎ s&A_Sç¬k´¼èR²a¼R]]¼xØá2èp9('KraÅv µlRùüÃsGÆTÂeÁ ÿɤ8ÎàÚH,z¢Ñ -k¶GZ¢¿FG¼ÊéXvÇÅe ÍtéÈs¢úXãÄlYßÑD"Ù%ÿïôAC+´9·uÝKÊïñí._Ý; ê{»þΦ¦v+mÔøªÎák;ËËêÕ^¼,ø:_ðø<öS$é3 cør <¢ãâ<£B2¿Þeõ æ74ìkx7ÒÒpKñ o·ÃdµAw:u¨vÉ ¿öµAÒû&@ésEÕ~Àß%#«Ð»lw xLÏð0Ö"óò_V0h²§Ã÷Ltj(Ó(;4üÀA81]kkµ©HsÃJ¯G?Hs¤ÓÀ?R6¼ì¸xjih >ìÂmeOPÌ.©rãÄåóaô£H¤óèP:z¦ÂÌÌLÊðEb¤]IƧ*ÍcÙ¯ «U×ñ¬0dµ]ôeÂó3*e6ö3G*³*jËhì13FHè/NòûÓ®Æå ÛÊ{VêÓ½ï!ÕÐÁwe?4\âÈðXT]]¦'´7áP »¼ÆÍLtæÑ·ö³>çYQ}þϾ~Þ§¿vÅ/óЯeF/½0úØ%c´\0úØcÄo]×ÚWí"Là 8éÂ8glúí¿àÒô1:êé9¯Ûmó¾õë7ÏnYû_»õêüS /jO»_Q1¦Øíà þ @¥I"ý#J¶+@פcÆb^I=NDuVÃxã4"×MÉädÚ®Y¥¨k9¶®"0 "Í@,C7°´êt]¾.îW?±LܸãBÀàË °ÊçctWÈyáãú äélë=HûÇ^æÄdƪ2NûCßp>2\cÛðXT]]V$½o ÈedÇfæÓí·fÅøóÖ®øÝù«?}eüç7Ê·!N|GÍo^9úáÖ£i½rÌ#±Ãt# ø©pnio>fåÞOv`ùfèýHkÃì\÷VhY0ðN¤¥á K5®, fR¦|餱éåÁ±Ll|qGùaE .ßdIÀjþÖm T ¤'#8'÷Ï Ø ¡ÉÕTïµ±è"þ»¡qݨtÚï& /_}hµje¯w@P¬öѳëBÒÁ²BP.·©>CR 8³7ø«U ¦²ñN93ÿ °£qIõ+ÕÕIïkÈÑA+Á¨Ñöôõ·æÓ©ç¯ýìµr±¿9fÁÏF?ûýá{ ¼ Ë .]ºÆw{ÚéTN`è¿Íu_é^ |¶¡9 ÄJÇÈÍåÁ¼ÿ +WPm4;UNdRê4¬©l]÷æ²þ/0(¤ ²¦b Äâ>e¿iDðÂë@8MQd9vjih 1´G¸~&³,VT+eY4ÑJûVðxã¬T½Ç_<5çKÔúß"Ð×Sdd&skÑ÷úþdV3ÑyHnq§ry/ðëÜôÓAïÜLfIÄ¿SÒ«»ËGý¸qÞéý¬uXÅà¬]qäykWÌßüÁÿ¿ÓÆ3óècoy8v®dñu^κMµK&UäÔ@ªåÈÛTÐH É|5ã}Å"
-
-
ZAP