Prepared for: Example Business Ltd · example-business.com
Your website is broadly functional but is missing several standard protections that attackers routinely look for. The most urgent issue is the lack of a Content Security Policy, which leaves visitors exposed to injected scripts. None of the fixes below require rebuilding your site — they're configuration changes your developer can apply quickly. Addressing the high and medium items would lift your score from 62 to an estimated 90+.
Your site doesn't tell browsers which scripts are allowed to run. If an attacker manages to inject code, it will execute and can quietly steal customer data.
Content-Security-Policy response header restricting scripts to trusted sources.External scripts load without an integrity check. If one of those providers is compromised, your site would load the tampered version.
integrity="...") hashes to third-party <script> tags.Visitors can be downgraded to an insecure connection, exposing logins and payment details on untrusted networks.
Strict-Transport-Security header with a long max-age.Your pages may leak private URLs and customer information to other sites your visitors click through to.
Referrer-Policy: strict-origin-when-cross-origin.A cookie is set without a SameSite flag, slightly increasing cross-site request risk.
SameSite=Lax (or Strict) on cookies.Analytics loads before any consent is captured, and the site has no linked privacy policy. If you have visitors in the UK/EU or California, both are common compliance gaps. We recommend adding a privacy policy and a consent step before non-essential tracking loads.
This is an illustrative sample using a fictional business to show the format and depth of a Sleak Check Audit. A real report reflects your own website's actual configuration. The audit is an external, point-in-time assessment and does not guarantee your site cannot be compromised.