Website security posture
Google Translate
Google's service, offered free of charge, instantly translates words, phrases, and web pages between English and over 100 other languages.
Last scanned 1 scan since Nov 6, 2026, 12:39 PM UTCtranslate.google.com/
This page shows the stored results of the latest scan. It is only recomputed when someone scans again.
Security posture
Security posture of translate.google.com: 13 checks passed, 3 warnings and 1 failed across HTTP headers, TLS, cookies, CORS, DNS and email authentication.
Public pages only show configuration that anyone can observe. Vulnerability matches, exposed files and secrets are never published; they appear only in the report of whoever ran the scan.
Configuration checks
Results of passive checks from the latest scan.
HTTPS & TLS
HTTPS
Served over HTTPS with a certificate the scanner's TLS stack accepted.
HTTP → HTTPS redirect
HTTP 301 to https://translate.google.com/
HTTP security headers
Strict-Transport-Security
Header missing.
Content-Security-Policy
script-src 'report-sample' 'nonce-hRV-NXbxY8UQ7d15xOWffg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateWebserverUi/cspreport;worker-
Framing protection
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options
nosniff
Referrer-Policy
Not set (browsers default to strict-origin-when-cross-origin).
Permissions-Policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form
Cross-Origin-Opener-Policy
same-origin-allow-popups
Version disclosure
No version numbers in Server / X-Powered-By headers.
Cookies
Cookie attributes
NID: no Secure, no SameSite
CORS
CORS policy
No Access-Control-Allow-Origin for a foreign origin.
Page content
Mixed content
No http:// subresources.
Form actions
No forms on the page.
Subresource Integrity
1 of 1 third-party script(s) without integrity attribute.
Public source maps
No source map references in fetched scripts.
security.txt
No valid /.well-known/security.txt (recommended so researchers can report issues).
DNS
CAA records
No CAA record: any certificate authority may issue certificates for the domain.
DNSSEC
Answers are not DNSSEC-signed.
Email authentication
SPF record
No SPF record found.
DMARC policy
p=reject at _dmarc.google.com
DKIM keys
The domain has no MX records, so DKIM was not checked.
MTA-STS
No MTA-STS record (optional: enforces TLS for inbound mail).
Detected technologies
Fingerprints from responses and page resources. They may not reflect everything the site uses.
How this was scanned
- • HTTP header, cookie, CORS & TLS checks - scanner, completed
- • Technology & version fingerprinting - scanner, completed
- • Client-side secrets, debug output & script supply chain - scanner, completed
- • DNS & email authentication - scanner, completed
Limitations
- • Passive scan: only publicly reachable responses were analysed. Content behind logins and client-side rendered routes may not be covered.
- • Version-based CVE matches rely on what the site discloses; distributions often backport fixes without changing version banners.
- • https://translate.google.com/ exceeded the size limit and was truncated.
- • Exposed-file probes, TLS cipher analysis and template-based checks run only after domain ownership verification.
Scan your own website for vulnerabilities
Scan public websites for free - no account needed. Go Pro for GitHub repository scans, source uploads, full CVE details, Compare and the API.