citycenter.csn.edu.pk

Scanned:

Score by axis

Want one of these looked at properly?

This scan is broad and passive — it reads what your site shows everyone, across all five areas. A deep audit takes one of those areas and goes all the way down on your site specifically.

Deep security auditDeep SEO audit

No email, no sign-up. Pick the one you care about.

Watch this site's security

We'll email you if its security slips: a new vulnerability, an expiring certificate, a blacklisting. No account needed.

Security alerts only. Nothing else, and no email unless something is wrong. Unsubscribe anytime.

Want more than security alerts?

Coming soon

Monitor: daily re-scans across all five axes, instant alerts on new and cert expiry, Telegram & web push, and full history.

Fix what matters first

  1. 1
    TLS certificate validityHow to fix this →

    Configure the server to send the full certificate chain, not just the site certificate, then reload it.

    +7
  2. 2
    Core security headersHow to fix this →

    Add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.

    +4
  3. 3
    Core Web Vitals (PageSpeed)

    Improve Core Web Vitals — see the PageSpeed Insights report for specifics.

    +8
  4. 4
    HSTS (Strict-Transport-Security)How to fix this →

    Add `Strict-Transport-Security: max-age=31536000; includeSubDomains`.

    +3
  5. 5
    Content-Security-PolicyHow to fix this →

    Add a Content-Security-Policy to mitigate and injection.

    +2

Recommendations are ranked by their impact on your score.

All checks

Security

56/ 100
  • Pass

    HTTPS & HTTP→HTTPS redirect

    HTTPS available; HTTP redirects to HTTPS

  • Fail

    TLS certificate validity

    citycenter.csn.edu.pk does not send the intermediate certificate (Sectigo Public Server Authentication CA DV R36), so anything without its own copy cannot verify this site

    chain: *.csn.edu.pk → (stops here) · not sent: Sectigo Public Server Authentication CA DV R36

    Configure the server to send the full certificate chain, not just the site certificate, then reload it.

  • Warn

    HSTS (Strict-Transport-Security)

    No Strict-Transport-Security header

    Add `Strict-Transport-Security: max-age=31536000; includeSubDomains`.

  • Warn

    Content-Security-Policy

    No Content-Security-Policy header

    Add a Content-Security-Policy to mitigate and injection.

  • Fail

    Core security headers

    None present

    Add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.

  • Pass

    Mixed content (HTTP on HTTPS)

    No insecure (http://) subresources

  • Pass

    SPF email anti-spoofing

    record present

    v=spf1 include:spf.protection.outlook.com -all
  • Pass

    DMARC email anti-spoofing

    record present

    v=DMARC1; p=none; rua=mailto:dmarc-reports@csn.edu.pk; ruf=mailto:dmarc-reports@csn.edu.pk; fo=1
  • Pass

    Vulnerable front-end libraries

    Recognized libraries have no known vulnerabilities

  • N/A

    CMS known vulnerabilities

    No CMS detected

Performance

41/ 100
  • Pass

    Time to First Byte

    Fast

    233 ms

    Fast: under 800 ms · Moderate: 800–1800 ms · Slow: over 1800 ms

  • Fail

    Text compression

    No compression detected

    Enable Brotli or Gzip compression for text responses.

  • Pass

    HTTP/2 or HTTP/3

    Modern

    HTTP/2.0

    Modern: HTTP/2 or HTTP/3 · Outdated: HTTP/1.1 or older

  • Warn

    Cache-Control

    No Cache-Control header

    Set Cache-Control to control caching of HTML and static assets.

  • Fail

    Core Web Vitals (PageSpeed)

    perf 35/100, 5.3 s, 0.00 (field)

    Good: 2.5 s or less · INP 200 ms or less

    Improve Core Web Vitals — see the PageSpeed Insights report for specifics.

SEO

40/ 100
  • Pass

    Page title

    11 characters

    City Center

    Good: 10–70 characters

  • Warn

    Meta description

    39 characters

    Web site created using create-react-app

    Good: 50–160 characters

    Aim for a meta description of about 50–160 characters.

  • Warn

    Canonical URL

    No canonical link

    Add <link rel="canonical"> to avoid duplicate-content issues.

  • Warn

    robots.txt

    No robots.txt found

    Add a robots.txt to guide crawlers.

  • Warn

    XML sitemap

    No sitemap found

    Publish a sitemap.xml and reference it from robots.txt.

  • Warn

    Single H1

    0 H1 tag(s)

    Add exactly one <h1> describing the page.

  • N/A

    Image alt text

    No images on the page

  • Warn

    Structured data (JSON-LD)

    No structured data

    Add schema.org to enable rich results.

6 SEO problems on this page. What about the rest of the site?

That is one page, checked from the outside. The faults that cost the most traffic only show up across a whole site — pages sharing a title, sections nothing links to, canonicals pointing at URLs that are gone.

A full audit crawls up to 100 pages and checks

  • Indexability and crawling
  • On-page and content
  • Technical
  • Structured data and social previews
  • Links
  • Site-wide configuration
Run a full SEO auditWhat it covers →

Free while in beta ($19 after launch). No domain verification — we only read pages your site already shows everyone.

Infrastructure

77/ 100
  • N/A

    CMS detection

    No CMS fingerprint detected

  • Pass

    Web server

    Identified

    Tengine
  • N/A

    CDN detection

    No CDN fingerprint detected

  • Pass

    TLS version

    Up to date

    TLS 1.3

    Up to date: TLS 1.2 or 1.3 · Deprecated: TLS 1.0 or 1.1

  • Warn

    IPv6 (AAAA record)

    No AAAA record

    Add an AAAA record to serve visitors over IPv6.

Reputation

100/ 100
  • Pass

    Google Safe Browsing

    Not flagged

    checked: Google Safe Browsing
  • Pass

    Domain blacklist status

    Not on major blocklists

    checked: Spamhaus DBL, SURBL
  • Pass

    Domain age

    Registered ~25 years ago

    2000-10-31

    Good: 90 days or more since registration

  • Pass

    Domain expiry

    Expires in 800 days

    2028-10-31

    Good: 30 days or more to expiry

Want one of these looked at properly?

This scan is broad and passive — it reads what your site shows everyone, across all five areas. A deep audit takes one of those areas and goes all the way down on your site specifically.

Deep security auditDeep SEO audit

No email, no sign-up. Pick the one you care about.

Go deeper

This scan is passive. An attacker won't be.

The free scan reads what your site shows everyone. A Deep Audit does what an attacker does: it actively probes your verified site for what's really exposed.

This free scan (passive)

  • Security score
  • Known-CVE counts
  • Security headers
  • TLS & certificate
  • Blacklist & Safe Browsing

Deep Audit: active scan of your verified site

  • Per-CVE breakdown: IDs, severity, exploit availability, fix version
  • Exposed files (.git, .env, backups)
  • Directory listing
  • Open admin panels
  • Open ports
  • Subdomain exposure
  • Prioritized fix plan
  • Full PDF report

What we can't check without your permission

These need active probing of your site: exposed .git/.env/backups, open admin panels, open ports, forgotten subdomains. Verify your domain and we'll show you what an attacker would find.

How it works

  1. Verify your domain: a file or DNS record, about 2 minutes.
  2. We actively scan it: a few minutes; we email you when it's ready.
  3. Get your full report + PDF.

The deep scan is live and free while we're in beta. Verify your domain and run it now.

Active checks run only on a domain you've verified as yours, with your consent. We detect, never exploit. Free in beta; $39 one-time after launch, no subscription, and early adopters keep the deep scan free.

Run a free deep scan

Share this report

Share on XShare on LinkedIn

Request removal of this report

Recently checked

See all reports →