Website security posture
OWASP Juice Shop | Probably the most modern and sophisticated insecure web application for security trainings, awareness demos and CTFs.
Probably the most modern and sophisticated insecure web application for security trainings, awareness demos and CTFs.
Last scanned 1 scan since Nov 5, 2026, 11:36 PM UTCjuice-shop.github.io/
This page shows the stored results of the latest scan. It is only recomputed when someone scans again.
Security posture
Security posture of juice-shop.github.io: 8 checks passed, 4 warnings and 2 failed across HTTP headers, TLS, cookies, CORS, DNS and email authentication.
Public pages only show configuration that anyone can observe. Vulnerability matches, exposed files and secrets are never published; they appear only in the report of whoever ran the scan.
Configuration checks
Results of passive checks from the latest scan.
HTTPS & TLS
HTTPS
Served over HTTPS with a certificate the scanner's TLS stack accepted.
HTTP → HTTPS redirect
HTTP 301 to https://juice-shop.github.io/
HTTP security headers
Strict-Transport-Security
max-age=31556952
Content-Security-Policy
No policy.
Framing protection
Neither X-Frame-Options nor CSP frame-ancestors.
X-Content-Type-Options
Header missing.
Referrer-Policy
Not set (browsers default to strict-origin-when-cross-origin).
Permissions-Policy
Not set (optional: restricts camera, microphone, geolocation…).
Cross-Origin-Opener-Policy
Not set (optional cross-window isolation).
Version disclosure
No version numbers in Server / X-Powered-By headers.
Cookies
Cookie attributes
The page set no cookies.
CORS
CORS policy
Access-Control-Allow-Origin: *.
Page content
Mixed content
No http:// subresources.
Form actions
No forms on the page.
Subresource Integrity
1 of 1 third-party script(s) without integrity attribute.
Public source maps
No source map references in fetched scripts.
security.txt
No valid /.well-known/security.txt (recommended so researchers can report issues).
DNS
CAA records
0 issue "digicert.com"; 0 issue "letsencrypt.org"; 0 issue "sectigo.com"; 0 issuewild "digicert.com"
DNSSEC
Answers are not DNSSEC-signed.
Email authentication
SPF record
No SPF record found.
DMARC policy
No DMARC record found.
DKIM keys
The domain has no MX records, so DKIM was not checked.
MTA-STS
No MTA-STS record (optional: enforces TLS for inbound mail).
Detected technologies
Fingerprints from responses and page resources. They may not reflect everything the site uses.
How this was scanned
- • HTTP header, cookie, CORS & TLS checks - scanner, completed
- • Technology & version fingerprinting - scanner, completed
- • Client-side secrets, debug output & script supply chain - scanner, completed
- • DNS & email authentication - scanner, completed
Limitations
- • Passive scan: only publicly reachable responses were analysed. Content behind logins and client-side rendered routes may not be covered.
- • Version-based CVE matches rely on what the site discloses; distributions often backport fixes without changing version banners.
- • Exposed-file probes, TLS cipher analysis and template-based checks run only after domain ownership verification.
Scan your own website for vulnerabilities
Scan public websites for free - no account needed. Go Pro for GitHub repository scans, source uploads, full CVE details, Compare and the API.