snag.page

github.com

Checked 15 Nov 2026, 19:23 UTC

1 thing to fix

1 low23 passed

What to fix

  1. 1

    DNSSEC is off

    Low

    DNS Answers about the domain can't be checked, so a resolver can be fed false ones.

    1. Turn on DNSSEC at your DNS host.
    2. Add the DS record it gives you at your registrar; where one company is both, it is often one switch.

    About this check

Also worth doing

  1. 2

    No Permissions-Policy

    Worth doing

    Headers Nothing limits what embedded content may ask for, such as the camera, microphone or location.

    1. Send the header below, turning off what the site never uses.
    Header
    Permissions-Policy: camera=(), microphone=(), geolocation=()

    About this check

  2. 3

    No Cross-Origin-Opener-Policy

    Worth doing

    Headers A window this page opens, or one that opened it, keeps a handle on it that can be misused.

    1. Send the header below; use same-origin-allow-popups if the site opens sign-in or payment windows.
    Header
    Cross-Origin-Opener-Policy: same-origin

    About this check

  3. 4

    No IPv6 address

    Worth doing

    DNS Visitors on IPv6-only networks reach it only through a translator, if at all.

    1. Ask your host for an IPv6 address, and add an AAAA record for it.

    About this check

  4. 5

    No MTA-STS

    Worth doing

    Email Servers sending you email may deliver it unencrypted if someone interferes with the connection.

    1. Publish a policy at https://mta-sts.github.com/.well-known/mta-sts.txt.
    2. Then add the record below, changing its id whenever the policy changes.
    TXT record at _mta-sts.github.com
    v=STSv1; id=1

    About this check

  5. 6

    No TLS reporting

    Worth doing

    Email Servers that can't deliver your email securely have nowhere to say so, so a broken certificate or MTA-STS policy goes unnoticed.

    1. Add the record below, with an address that can take a daily report.
    TXT record at _smtp._tls.github.com
    v=TLSRPTv1; rua=mailto:tls-reports@github.com

    About this check

Quality

1 to improve1 passed

  1. 7

    No llms.txt

    Worth doing

    AI and agents An llms.txt gives AI assistants a short guide to the site and links to plain versions of its pages.

    1. Publish /llms.txt in Markdown: a heading with the site's name, a one-line summary, then links to the pages that matter.
    /llms.txt
    # Site name

> What the site does, in a sentence.

## Pages

- [About](https://github.com/about): who runs it

    About this check

All checks

31

DNS

  • DNSSEC is off
  • No IPv6 address
  • CAA limits who can issue certificatesAllowed: digicert.com, globalsign.com, letsencrypt.org, sectigo.com.
  • The domain is registered for over a monthUntil 2028-10-09.
  • The domain is locked against transfer

Headers

  • No Permissions-Policy
  • No Cross-Origin-Opener-Policy
  • Content-Security-Policy is set
  • Other sites can't frame it
  • Browsers keep to the content type
  • The referrer policy is safeWith no Referrer-Policy, browsers send other sites only the domain.
  • No software versions in headers
  • Other sites can't read it as the visitor

Email

  • No MTA-STS
  • No TLS reporting
  • SPF is setv=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all
  • SPF takes 10 of the 10 lookups allowed
  • DMARC is enforcedp=quarantine.
  • DKIM is set upKeys found for google, selector1, k1, s1.
  • Every mail server existsgithub-com.mail.protection.outlook.com.

AI and agents

HTTPS

  • Answers over HTTPShttps://github.com/ answered 429.
  • Sends http:// to https://
  • HSTS is onFor 365 days, subdomains included, ready to preload.
  • github.com and www.github.com both lead to github.com

Cookies

  • Sets no cookies on the home page

Security contact

  • Publishes a security contact

Exposed files

  • No exposed files found49 well-known paths checked.

Open services

  • No risky services seen openNothing Shodan's scans found on its address is a database, remote access or a container API, and no known flaws are listed.

Reputation

Loading

  • No redirects before the page

Speed for real visitors

Fails Core Web Vitals

Loading LCP

2.3 s

Good

78% good9% poor

Responsiveness INP

245 ms

Needs work

70% good7% poor

Visual stability CLS

0.06

Good

87% good6% poor

First content FCP

2.0 s

Needs work

Server response TTFB

1.2 s

Needs work

Passes Core Web Vitals

Loading LCP

1.7 s

Good

89% good4% poor

Responsiveness INP

62 ms

Good

95% good1% poor

Visual stability CLS

0.04

Good

87% good4% poor

First content FCP

1.5 s

Good

Server response TTFB

1.1 s

Needs work

The 75th percentile of Chrome users' page loads at github.com, 17 Oct 2026 to 13 Nov 2026.