HTTP Security Headers
auto.ru
Final status: 200 · Server: nginx
http://auto.ru (301)https://auto.ru/ (302)https://auto.ru/showcaptcha?cc=1&form-fb-hint=2.21.41e93a007a131396ef8c85659d045c9603335330d55106d95517b24258c17b73f9f7c12bbb4295360cd58f053e7c5fd713872c7bfb10b4e92214bb&mt=72969A7274766F323E36C4E1FD863AB023EC683C72C09541CD082F93A488822347EAE4DB08F5D7265F2117151514E2F975B9E88AB80B7A493B56AE68C45EB98E7E741FAFE9D6B5F039D7BF793077011F10160538C32FD6E7E6551327EBBBE4466E9C37FC58D98A020472870428BA95D4815A14B88D9A18CAC2B929D79AC57BA0C1F82B63A7406D0D52E67A9C57E7E2FF4B9E4E6C84F97DBDEB&retpath=aHR0cHM6Ly9hdXRvLnJ1Lw%2C%2C_1c745ea10b1b04e0e3ef5faea03b5e2e&t=2%252F1794434420%252Fc562048b151dffb5070f96930681ac6e&u=9741991028721870676&s=76104c569e23bd8106c31d2a25669afa (200)
Security Headers
Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS, preventing protocol-downgrade attacks.
Content-Security-Policy (CSP) — missing
Limits where scripts/resources can load from — the strongest defense against XSS.
X-Frame-Options — missing
Blocks the site from being embedded in iframes (clickjacking protection).
X-Content-Type-Options — missing
Stops browsers from MIME-sniffing responses away from the declared type.
Referrer-Policy — missing
Controls how much referrer information is sent to other sites.
Permissions-Policy — missing
Restricts access to browser features like camera, microphone, geolocation.