content-security-policy

Content Security Policy (CSP) header not implemented

cookies

Cookies set without using the Secure flag or set over HTTP

Public content is visible via cross-origin resource sharing (CORS) Access-Control-Allow-Origin header

HTTP Strict Transport Security (HSTS) header not implemented

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

X-Content-Type-Options header not implemented

X-Frame-Options (XFO) header not implemented

Deprecated X-XSS-Protection header not implemented

TYPO3 is a free and open-source Web content management system written in PHP.

PHP is a general-purpose scripting language used for web development.

Impact	Description	Documentation
-25		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-20		OWASP Session Management Cheat Sheet.
-20		-
-20		Doc header Strict-Transport-Security (HSTS).
-20		Doc header X-Frame-Options.
-5		Doc header X-Content-Type-Options.