{"en":{"brandSub":"Scan","kicker":"Free · passive · no sign-up","title":"How safe does your website look from outside?","lead":"Type your domain. We check what any visitor or DNS lookup can see, then explain it in plain words.","label":"Domain","go":"Check","w1":"HTTPS & certificate","w2":"Browser security headers","w3":"Cookies","w4":"Email spoofing (SPF, DMARC, DKIM)","w5":"DNSSEC & CAA","fIssues":"Issues first","fOnly":"Only issues","basic":"Basic","advanced":"Advanced","cta1":"Built by PlixyLabs. This is a quick outside check, not a pentest.","cta2":"Need a full pentest?","ctaBtn":"Contact","privacy":"We only look at public information. We don't store your domain or IP; results are kept in memory for 10 minutes so repeat checks are fast.","scanning":"Checking… this takes a few seconds.","lang":"العربية","pdf":"Download PDF","fixAll":"Fix it for me","fixOne":"Fix it for me","noIssues":"No issues in this section.","st":{"pass":"Good","warn":"Improve","fail":"Fix","info":"Note"},"cnt":["{n} good","{n} to improve","{n} to fix"],"verdict":{"A":"Strong setup. Only small things left.","B":"Good, with a few gaps to close.","C":"Okay, but several protections are missing.","D":"Weak. Important protections are missing.","F":"At risk. Fix the red items first."},"fine":"Checked {t}{c}. Passive check only: no attacks, no port scans.","cached":" (cached result)","err":{"invalid":"That doesn't look like a domain. Try something like example.com.","blocked":"That name is not on the public internet.","private":"This domain points to a private or reserved address, so we won't check it.","noresolve":"We couldn't find this domain in DNS.","ratelimit":"Too many requests from your network. Try again in {m} min.","busy":"We're busy right now. Try again in a few seconds.","timeout":"The site took too long to answer.","failed":"Something went wrong. Please try again.","net":"Connection problem. Please try again.","notscanned":"Run the check again, then download the PDF.","captcha":"Please complete the quick human check, then try again.","captchadown":"The human check is unavailable right now. Please try again in a minute.","dailycap":"We've reached today's limit of free checks. Please come back tomorrow, or contact us for a full review."},"mailSubject":"Security fixes for {d}","mailIntro":"Hi Ahmed, I ran the PlixyLabs free check on {d} (grade {g}) and would like help fixing:","pdfTitle":"Website security check","pdfFor":"Report for","pdfDate":"Checked on","pdfTz":"Asia/Riyadh, UTC+3","pdfScore":"Score","pdfIssues":"What to fix first","pdfAll":"All checks","pdfFix":"How to fix","pdfNote":"This is a passive outside check: it only looks at what any visitor or DNS lookup can see. It is not a penetration test and can't find problems inside your app.","pdfCta":"Want a full pentest or help fixing these? plixylabs.cc/contact","c":{"https":{"n":"HTTPS (secure connection)","pass":"Your site loads over an encrypted connection.","cert":"HTTPS works, but the certificate has a problem.","private":"The HTTPS version points to a private address.","fail":"We couldn't open your site over HTTPS.","fix":"Turn on HTTPS with a free certificate (e.g. Let's Encrypt or Cloudflare)."},"cert":{"n":"Certificate","pass":"Valid, from {issuer}. Expires in {days} days ({expires}).","warn":"Expires very soon: {days} days left ({expires}).","invalid":"Browsers will show a warning: {error}.","expired":"The certificate has expired ({expires}).","fix":"Renew the certificate and turn on automatic renewal."},"tls":{"n":"Encryption version","best":"Uses {version}, the newest.","pass":"Uses {version}.","fail":"Uses old {version}.","fix":"Allow only TLS 1.2 and 1.3 in your server or CDN settings."},"redirect":{"n":"HTTP → HTTPS redirect","pass":"Visitors typing http:// are sent to the secure version.","nohttp":"Plain HTTP isn't offered at all, which is fine.","warn":"The redirect goes somewhere we won't follow.","fail":"Visitors on http:// stay on the unencrypted version.","fix":"Add a permanent (301) redirect from http:// to https://."},"hsts":{"n":"HSTS (always use HTTPS)","pass":"Browsers are told to always use HTTPS ({days} days).","warn":"Set, but short: {days} days.","fail":"Browsers aren't told to always use HTTPS.","fix":"Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains"},"csp":{"n":"Content Security Policy","pass":"A policy limits which scripts can run. Good defence against injected code.","warn":"A policy exists but allows risky sources: {weak}.","reportonly":"Only in 'report-only' mode, so it doesn't block anything yet.","fail":"No policy limiting which scripts can run.","fix":"Add a Content-Security-Policy header; start with default-src 'self' and adjust."},"frame":{"n":"Clickjacking protection","pass":"Other sites can't embed your pages to trick visitors.","fail":"Other sites could embed your pages in a hidden frame.","fix":"Add X-Frame-Options: DENY (or CSP frame-ancestors 'self')."},"xcto":{"n":"File-type sniffing","pass":"Browsers are told not to guess file types.","fail":"Browsers may guess file types, which can be abused.","fix":"Add header: X-Content-Type-Options: nosniff"},"referrer":{"n":"Referrer policy","pass":"Links don't leak full page addresses ({value}).","warn":"Policy \"{value}\" can leak full page addresses.","fail":"No policy, so full page addresses may leak to other sites.","fix":"Add header: Referrer-Policy: strict-origin-when-cross-origin"},"permissions":{"n":"Permissions policy","pass":"Camera, microphone etc. are limited by policy.","warn":"No policy limiting camera, microphone, location.","fix":"Add a Permissions-Policy header, e.g. camera=(), microphone=(), geolocation=()"},"leak":{"n":"Software version leak","pass":"Your server doesn't show software versions.","warn":"Shows versions: {items}.","fix":"Hide version numbers in Server / X-Powered-By headers."},"cookies":{"n":"Cookies","info":"No cookies set on the home page.","pass":"All {count} cookies have Secure, HttpOnly and SameSite.","warn":"Missing flags: {bad}.","fix":"Set cookies with Secure; HttpOnly; SameSite=Lax (HttpOnly unless JavaScript needs it)."},"mixed":{"n":"Mixed content","pass":"The home page doesn't load scripts, styles or images over plain http://.","fail":"The page loads files over plain http:// from: {hosts}.","fix":"Change every http:// file link on the page to https://."},"spf":{"n":"SPF (who may send your email)","pass":"Set, ends with {policy}.","neutral":"Set, but ?all doesn't block anyone.","noall":"Set, but with no clear 'all' rule.","plusall":"+all lets anyone send email as you.","multiple":"More than one SPF record, so it's ignored.","fail":"No SPF: anyone can pretend to send email from your domain.","fix":"Keep one TXT record like: v=spf1 include:<your mail provider> -all"},"dmarc":{"n":"DMARC (stop fake emails)","reject":"Policy \"reject\": fake emails get rejected.","quarantine":"Policy \"quarantine\": fake emails go to spam.","none":"Policy \"{policy}\" only watches; fake emails still get delivered.","fail":"No DMARC: fake emails using your name aren't stopped.","fix":"Set TXT at _dmarc: v=DMARC1; p=quarantine; rua=mailto:you@yourdomain (later p=reject)."},"dkim":{"n":"DKIM (email signature)","pass":"Found key for selector: {selectors}.","nullkey":"Only empty (revoked) keys found among common selectors.","notfound":"Not found among common selectors. It may still exist under another name.","fix":"Turn on DKIM signing in your email provider and publish its key."},"mx":{"n":"Email servers (MX)","pass":"Email is handled by: {hosts}.","nullmx":"This domain says it doesn't receive email (null MX).","none":"No email servers set for this domain.","fix":""},"securitytxt":{"n":"security.txt","pass":"Researchers know how to report problems to you.","expired":"Your security.txt has expired.","warn":"No security.txt, so people can't easily report problems.","fix":"Publish /.well-known/security.txt with Contact and Expires lines."},"tls_old":{"n":"Old TLS 1.0 / 1.1","pass":"Old TLS 1.0 and 1.1 are turned off.","fail":"Still accepts old {versions}.","unknown":"We couldn't test old TLS versions.","fix":"Turn off TLS 1.0 and 1.1; keep only TLS 1.2 and 1.3."},"cipher":{"n":"Cipher strength","pass":"Only strong ciphers with forward secrecy.","nofs":"Still accepts older ciphers without forward secrecy (RSA key exchange).","weak":"Accepts broken ciphers (NULL / EXPORT / RC4 / 3DES).","fix":"Allow only ECDHE + AES-GCM / ChaCha20 ciphers (e.g. Mozilla 'intermediate')."},"chain":{"n":"Certificate chain","pass":"The full chain is sent, so all devices trust it.","fail":"The middle (intermediate) certificate is missing; some devices will show errors.","other":"Chain could not be checked: {error}.","fix":"Install the full chain (fullchain.pem) on your server."},"hostname":{"n":"Certificate name match","pass":"The certificate covers this name ({names}).","fail":"The certificate is for other names ({names}).","fix":"Issue a certificate that includes this exact domain."},"certkey":{"n":"Certificate key","pass":"Strong key: {key}, signed with {sig}.","fail":"Weak key or signature: {key}, {sig}.","fix":"Use RSA 2048+ or ECDSA P-256 with SHA-256."},"ocsp":{"n":"OCSP stapling","pass":"The server attaches the certificate's status, so pages open faster.","info":"Not stapled. Fine, but turning it on saves a lookup for visitors.","fix":""},"hsts_preload":{"n":"HSTS subdomains & preload","preloaded":"On the browsers' HSTS preload list.","flags":"Covers subdomains too. Not on the preload list (optional).","nosub":"HSTS doesn't cover subdomains.","nohsts":"Needs HSTS first.","fix":"Add includeSubDomains to HSTS once every subdomain has HTTPS; preload is optional."},"csp_details":{"n":"CSP details","pass":"Also blocks plugins (object-src) and base-tag tricks (base-uri).","warn":"Missing: {missing}.","nocsp":"Needs a CSP first.","fix":"Add object-src 'none'; base-uri 'none' (or 'self') to your CSP."},"isolation":{"n":"Cross-origin isolation","pass":"Sets {have}: other sites' windows can't reach yours.","warn":"No Cross-Origin-Opener-Policy (have: {have}).","fix":"Add header: Cross-Origin-Opener-Policy: same-origin"},"cors":{"n":"CORS (sharing with other sites)","pass":"Other websites can't read your pages.","public":"Any site may read the home page (Access-Control-Allow-Origin: *). Fine for public content.","reflect":"Your server trusts any website that asks.","reflectcreds":"Any website can read pages as your logged-in visitors.","unknown":"Couldn't check.","fix":"Only allow exact, trusted origins; never reflect Origin with Allow-Credentials: true."},"sri":{"n":"Third-party script integrity","pass":"Third-party scripts are locked with integrity hashes.","nothird":"No third-party scripts on the home page.","warn":"Scripts from other sites without integrity check: {hosts}.","fix":"Add integrity=\"sha384-…\" crossorigin to third-party <script> tags, or host them yourself."},"libs":{"n":"Outdated JavaScript libraries","info":"No well-known library versions visible in the page.","found":"Seen: {libs}. No known-old versions.","fail":"Old versions with public security issues: {libs}.","fix":"Update these libraries to their latest versions."},"infoleak":{"n":"Debug / internal headers","pass":"No debug or internal-server headers.","timing":"Sends Server-Timing (shows internal timing). Usually harmless.","warn":"Shows internal details: {headers}.","fix":"Remove debug and backend headers in production."},"cookie_prefix":{"n":"Cookie prefixes","pass":"Cookie prefixes are fine.","broken":"Prefix rules broken: {names}.","suggest":"Session cookies could use the __Host- prefix: {names}.","nocookies":"No cookies to check.","fix":"__Host- cookies need Secure, Path=/ and no Domain; __Secure- cookies need Secure."},"spf_lookups":{"n":"SPF lookup limit","pass":"Uses {count} of the 10 allowed DNS lookups.","ptr":"Uses the slow, discouraged 'ptr' rule.","fail":"Needs {count} DNS lookups; over 10 means SPF breaks.","nospf":"Needs a single SPF record first.","fix":"Remove unused include: entries or flatten them to stay under 10 lookups."},"dmarc_details":{"n":"DMARC reports & coverage","pass":"Sends reports (rua), covers 100%, subdomains: {sp}.","warn":"Weak spots: {missing}.","nodmarc":"Needs DMARC first.","fix":"Add rua=mailto:…, keep pct=100, and don't set sp=none."},"mta_sts":{"n":"MTA-STS (encrypted incoming mail)","pass":"Mail servers must use encryption to reach you (enforce).","testing":"Policy is in '{mode}' mode, not enforced yet.","nopolicy":"TXT record exists but the policy file is missing or broken.","warn":"Not set: mail to you could be sent unencrypted.","nomail":"No email on this domain.","fix":"Publish _mta-sts TXT and https://mta-sts.<domain>/.well-known/mta-sts.txt with mode: enforce."},"tlsrpt":{"n":"TLS-RPT (mail delivery reports)","pass":"You get reports when encrypted mail delivery fails.","info":"No TLS-RPT record. Optional.","fix":""},"bimi":{"n":"BIMI (logo in inbox)","pass":"BIMI record found.","info":"No BIMI record. Optional; needs DMARC enforcement.","fix":""},"dnssec":{"n":"DNSSEC","pass":"Your DNS answers are signed, so they're hard to fake.","warn":"DNS answers aren't signed.","fix":"Turn on DNSSEC at your DNS host and add the DS record at your registrar."},"caa":{"n":"CAA (who may issue certificates)","pass":"Limited to: {records}.","warn":"Any certificate company may issue certificates for you.","fix":"Add CAA records naming only the certificate authorities you use."},"caa_iodef":{"n":"CAA alerts (iodef)","pass":"You'll be told about blocked certificate requests.","info":"No iodef contact in CAA. Optional.","nocaa":"Needs CAA first.","fix":""},"ipv6":{"n":"IPv6","pass":"Reachable over IPv6.","info":"No IPv6 address. Optional.","fix":""},"http2":{"n":"HTTP/2 & HTTP/3","pass":"Supports {protos} (faster loading).","info":"Only {protos}. Turning on HTTP/2 makes pages faster.","fix":""},"robots":{"n":"robots.txt & sitemap","pass":"Both found.","info":"robots.txt: {robots} · sitemap: {sitemap}. Good for search engines, not security.","fix":""},"www":{"n":"www vs. no-www","pass":"{twin} and {main} end up at the same address.","warn":"{twin} ends up at {lands}, not {main}.","broken":"{twin} exists but doesn't work over HTTPS.","notwin":"{twin} isn't set up. That's fine.","skipped":"{twin} points somewhere we won't check.","fix":"Redirect one version (e.g. www) to the other with a 301."}}},"ar":{"brandSub":"فحص","kicker":"مجاني · فحص خارجي · بدون تسجيل","title":"كيف يبدو أمان موقعك من الخارج؟","lead":"اكتب نطاق موقعك. نفحص ما يراه أي زائر أو أي استعلام DNS، ونشرح النتيجة بكلمات بسيطة.","label":"النطاق","go":"افحص","w1":"HTTPS والشهادة","w2":"ترويسات أمان المتصفح","w3":"الكوكيز","w4":"انتحال البريد (SPF وDMARC وDKIM)","w5":"DNSSEC وCAA","fIssues":"المشاكل أولاً","fOnly":"المشاكل فقط","basic":"أساسي","advanced":"متقدم","cta1":"من تطوير PlixyLabs. هذا فحص خارجي سريع وليس اختبار اختراق.","cta2":"تحتاج اختبار اختراق كامل؟","ctaBtn":"تواصل معي","privacy":"نفحص المعلومات العامة فقط. لا نحفظ نطاقك ولا عنوان IP الخاص بك، والنتائج تبقى في الذاكرة 10 دقائق فقط لتسريع إعادة الفحص.","scanning":"جارٍ الفحص… يستغرق بضع ثوانٍ.","lang":"English","pdf":"تحميل PDF","fixAll":"أصلحها لي","fixOne":"أصلحها لي","noIssues":"لا توجد مشاكل في هذا القسم.","st":{"pass":"جيد","warn":"حسّن","fail":"أصلح","info":"ملاحظة"},"cnt":["{n} جيد","{n} للتحسين","{n} للإصلاح"],"verdict":{"A":"إعداد قوي. بقيت أمور بسيطة فقط.","B":"جيد، مع بعض الثغرات التي يجب إغلاقها.","C":"مقبول، لكن تنقصه عدة حمايات.","D":"ضعيف. تنقصه حمايات مهمة.","F":"في خطر. ابدأ بإصلاح البنود الحمراء."},"fine":"تم الفحص {t}{c}. فحص خارجي فقط: بدون هجمات وبدون فحص منافذ.","cached":" (نتيجة محفوظة مؤقتاً)","err":{"invalid":"هذا لا يبدو نطاقاً. جرّب مثلاً example.com.","blocked":"هذا الاسم ليس على الإنترنت العام.","private":"هذا النطاق يشير إلى عنوان خاص أو محجوز، لذلك لن نفحصه.","noresolve":"لم نجد هذا النطاق في DNS.","ratelimit":"طلبات كثيرة من شبكتك. حاول بعد {m} دقيقة.","busy":"الخدمة مشغولة الآن. حاول بعد ثوانٍ.","timeout":"الموقع تأخر كثيراً في الرد.","failed":"حدث خطأ. حاول مرة أخرى.","net":"مشكلة في الاتصال. حاول مرة أخرى.","notscanned":"أعد الفحص ثم حمّل ملف PDF.","captcha":"أكمل التحقق السريع بأنك إنسان، ثم حاول مرة أخرى.","captchadown":"التحقق غير متاح الآن. حاول بعد دقيقة.","dailycap":"وصلنا للحد اليومي للفحوصات المجانية. عُد غداً، أو تواصل معنا لمراجعة كاملة."},"mailSubject":"إصلاحات أمنية لـ {d}","mailIntro":"مرحباً أحمد، فحصت {d} بأداة PlixyLabs المجانية (التقييم {g}) وأحتاج مساعدة في إصلاح:","pdfTitle":"فحص أمان الموقع","pdfFor":"تقرير لـ","pdfDate":"تاريخ الفحص","pdfTz":"توقيت الرياض، UTC+3","pdfScore":"النتيجة","pdfIssues":"ابدأ بإصلاح هذه","pdfAll":"كل الفحوصات","pdfFix":"طريقة الإصلاح","pdfNote":"هذا فحص خارجي فقط: ينظر لما يراه أي زائر أو استعلام DNS. ليس اختبار اختراق ولا يكشف المشاكل داخل تطبيقك.","pdfCta":"تريد اختبار اختراق كامل أو مساعدة في الإصلاح؟ plixylabs.cc/contact","c":{"https":{"n":"HTTPS (اتصال آمن)","pass":"موقعك يفتح عبر اتصال مشفّر.","cert":"HTTPS يعمل، لكن في الشهادة مشكلة.","private":"نسخة HTTPS تشير إلى عنوان خاص.","fail":"لم نتمكن من فتح موقعك عبر HTTPS.","fix":"فعّل HTTPS بشهادة مجانية (مثل Let's Encrypt أو Cloudflare)."},"cert":{"n":"الشهادة","pass":"صالحة، من {issuer}. تنتهي بعد {days} يوماً ({expires}).","warn":"تنتهي قريباً جداً: بقي {days} يوماً ({expires}).","invalid":"المتصفح سيعرض تحذيراً: {error}.","expired":"الشهادة منتهية ({expires}).","fix":"جدّد الشهادة وفعّل التجديد التلقائي."},"tls":{"n":"إصدار التشفير","best":"يستخدم {version}، وهو الأحدث.","pass":"يستخدم {version}.","fail":"يستخدم إصداراً قديماً {version}.","fix":"اسمح فقط بـ TLS 1.2 و1.3 في إعدادات الخادم أو CDN."},"redirect":{"n":"التحويل من HTTP إلى HTTPS","pass":"من يكتب http:// يُحوَّل للنسخة الآمنة.","nohttp":"الموقع لا يقدّم HTTP غير المشفّر أصلاً، وهذا جيد.","warn":"التحويل يذهب لمكان لن نتبعه.","fail":"زوار http:// يبقون على النسخة غير المشفّرة.","fix":"أضف تحويلاً دائماً (301) من http:// إلى https://."},"hsts":{"n":"HSTS (استخدم HTTPS دائماً)","pass":"المتصفح مُلزَم باستخدام HTTPS دائماً ({days} يوماً).","warn":"موجود لكن مدته قصيرة: {days} يوماً.","fail":"المتصفح غير مُلزَم باستخدام HTTPS دائماً.","fix":"أضف الترويسة: Strict-Transport-Security: max-age=31536000; includeSubDomains"},"csp":{"n":"سياسة أمان المحتوى (CSP)","pass":"توجد سياسة تحدد السكربتات المسموحة. حماية جيدة من الأكواد المحقونة.","warn":"توجد سياسة لكنها تسمح بمصادر خطرة: {weak}.","reportonly":"السياسة في وضع 'التقرير فقط' ولا تمنع شيئاً بعد.","fail":"لا توجد سياسة تحدد السكربتات المسموحة.","fix":"أضف ترويسة Content-Security-Policy وابدأ بـ default-src 'self' ثم عدّل."},"frame":{"n":"الحماية من التضمين الخادع","pass":"المواقع الأخرى لا تستطيع تضمين صفحاتك لخداع الزوار.","fail":"يمكن لمواقع أخرى تضمين صفحاتك في إطار مخفي.","fix":"أضف X-Frame-Options: DENY (أو CSP frame-ancestors 'self')."},"xcto":{"n":"تخمين نوع الملفات","pass":"المتصفح مُلزَم بعدم تخمين نوع الملفات.","fail":"قد يخمّن المتصفح نوع الملفات، ويمكن استغلال ذلك.","fix":"أضف الترويسة: X-Content-Type-Options: nosniff"},"referrer":{"n":"سياسة المُحيل","pass":"الروابط لا تكشف عناوين الصفحات كاملة ({value}).","warn":"السياسة \"{value}\" قد تكشف عناوين الصفحات كاملة.","fail":"لا توجد سياسة، فقد تُكشف عناوين صفحاتك لمواقع أخرى.","fix":"أضف الترويسة: Referrer-Policy: strict-origin-when-cross-origin"},"permissions":{"n":"سياسة الأذونات","pass":"الكاميرا والميكروفون وغيرها محدودة بسياسة.","warn":"لا توجد سياسة تحدّ من الكاميرا والميكروفون والموقع.","fix":"أضف ترويسة Permissions-Policy مثل: camera=(), microphone=(), geolocation=()"},"leak":{"n":"كشف إصدارات البرامج","pass":"الخادم لا يكشف إصدارات البرامج.","warn":"يكشف إصدارات: {items}.","fix":"أخفِ أرقام الإصدارات من ترويستي Server وX-Powered-By."},"cookies":{"n":"الكوكيز","info":"لا توجد كوكيز في الصفحة الرئيسية.","pass":"كل الكوكيز ({count}) فيها Secure وHttpOnly وSameSite.","warn":"خصائص ناقصة: {bad}.","fix":"اضبط الكوكيز بـ Secure; HttpOnly; SameSite=Lax (HttpOnly إلا إذا احتاجها JavaScript)."},"mixed":{"n":"المحتوى المختلط","pass":"الصفحة الرئيسية لا تحمّل سكربتات أو تنسيقات أو صوراً عبر http:// غير المشفّر.","fail":"الصفحة تحمّل ملفات عبر http:// غير المشفّر من: {hosts}.","fix":"غيّر كل روابط الملفات في الصفحة من http:// إلى https://."},"spf":{"n":"SPF (من يحق له الإرسال باسمك)","pass":"موجود، وينتهي بـ {policy}.","neutral":"موجود لكن ?all لا يمنع أحداً.","noall":"موجود لكن بدون قاعدة 'all' واضحة.","plusall":"‏+all يسمح لأي أحد بالإرسال باسمك.","multiple":"يوجد أكثر من سجل SPF، لذلك يتم تجاهله.","fail":"لا يوجد SPF: أي أحد يستطيع انتحال بريد نطاقك.","fix":"أبقِ سجل TXT واحداً مثل: v=spf1 include:<مزوّد بريدك> -all"},"dmarc":{"n":"DMARC (إيقاف البريد المزيّف)","reject":"السياسة \"reject\": البريد المزيّف يُرفض.","quarantine":"السياسة \"quarantine\": البريد المزيّف يذهب للبريد المزعج.","none":"السياسة \"{policy}\" تراقب فقط؛ البريد المزيّف ما زال يصل.","fail":"لا يوجد DMARC: البريد المزيّف باسمك لا يتم إيقافه.","fix":"اضبط TXT في _dmarc: v=DMARC1; p=quarantine; rua=mailto:you@yourdomain (ثم p=reject لاحقاً)."},"dkim":{"n":"DKIM (توقيع البريد)","pass":"وجدنا مفتاحاً للمحدِّد: {selectors}.","nullkey":"وجدنا مفاتيح فارغة (ملغاة) فقط بين المحدِّدات الشائعة.","notfound":"غير موجود بين المحدِّدات الشائعة. قد يكون موجوداً باسم آخر.","fix":"فعّل توقيع DKIM في مزوّد بريدك وانشر مفتاحه."},"mx":{"n":"خوادم البريد (MX)","pass":"البريد يُستقبل عبر: {hosts}.","nullmx":"هذا النطاق يعلن أنه لا يستقبل بريداً (null MX).","none":"لا توجد خوادم بريد لهذا النطاق.","fix":""},"securitytxt":{"n":"ملف security.txt","pass":"الباحثون يعرفون كيف يبلغونك عن المشاكل.","expired":"ملف security.txt منتهي الصلاحية.","warn":"لا يوجد security.txt، فيصعب على الناس إبلاغك بالمشاكل.","fix":"انشر /.well-known/security.txt يحتوي سطري Contact وExpires."},"tls_old":{"n":"TLS القديم 1.0 / 1.1","pass":"إصدارا TLS 1.0 و1.1 القديمان معطّلان.","fail":"ما زال يقبل الإصدار القديم {versions}.","unknown":"لم نتمكن من فحص إصدارات TLS القديمة.","fix":"عطّل TLS 1.0 و1.1 وأبقِ فقط TLS 1.2 و1.3."},"cipher":{"n":"قوة التشفير","pass":"يقبل فقط تشفيراً قوياً مع سرية أمامية.","nofs":"ما زال يقبل تشفيراً أقدم بدون سرية أمامية (تبادل مفاتيح RSA).","weak":"يقبل تشفيراً مكسوراً (NULL / EXPORT / RC4 / 3DES).","fix":"اسمح فقط بتشفير ECDHE مع AES-GCM أو ChaCha20 (مثل إعداد Mozilla 'intermediate')."},"chain":{"n":"سلسلة الشهادات","pass":"السلسلة كاملة، فتثق بها كل الأجهزة.","fail":"الشهادة الوسيطة ناقصة؛ بعض الأجهزة ستعرض أخطاء.","other":"تعذّر فحص السلسلة: {error}.","fix":"ثبّت السلسلة الكاملة (fullchain.pem) على الخادم."},"hostname":{"n":"تطابق اسم الشهادة","pass":"الشهادة تغطي هذا الاسم ({names}).","fail":"الشهادة لأسماء أخرى ({names}).","fix":"أصدر شهادة تتضمن هذا النطاق بالضبط."},"certkey":{"n":"مفتاح الشهادة","pass":"مفتاح قوي: {key}، موقّع بـ {sig}.","fail":"مفتاح أو توقيع ضعيف: {key}، {sig}.","fix":"استخدم RSA 2048 أو أكثر، أو ECDSA P-256 مع SHA-256."},"ocsp":{"n":"تدبيس OCSP","pass":"الخادم يرفق حالة الشهادة، فتفتح الصفحات أسرع.","info":"غير مفعّل. لا بأس، لكن تفعيله يوفّر استعلاماً على الزوار.","fix":""},"hsts_preload":{"n":"HSTS للنطاقات الفرعية والقائمة المسبقة","preloaded":"موجود في قائمة HSTS المسبقة للمتصفحات.","flags":"يشمل النطاقات الفرعية. غير موجود في القائمة المسبقة (اختياري).","nosub":"HSTS لا يشمل النطاقات الفرعية.","nohsts":"يحتاج HSTS أولاً.","fix":"أضف includeSubDomains إلى HSTS بعد التأكد أن كل النطاقات الفرعية تعمل بـ HTTPS؛ القائمة المسبقة اختيارية."},"csp_details":{"n":"تفاصيل CSP","pass":"تمنع أيضاً الإضافات (object-src) وحيل وسم base ‏(base-uri).","warn":"ينقصها: {missing}.","nocsp":"تحتاج CSP أولاً.","fix":"أضف object-src 'none'; base-uri 'none' (أو 'self') إلى CSP."},"isolation":{"n":"العزل بين المواقع","pass":"يضبط {have}: نوافذ المواقع الأخرى لا تصل لموقعك.","warn":"لا توجد Cross-Origin-Opener-Policy (الموجود: {have}).","fix":"أضف الترويسة: Cross-Origin-Opener-Policy: same-origin"},"cors":{"n":"CORS (المشاركة مع مواقع أخرى)","pass":"المواقع الأخرى لا تستطيع قراءة صفحاتك.","public":"أي موقع يستطيع قراءة الصفحة الرئيسية (Access-Control-Allow-Origin: *). لا بأس للمحتوى العام.","reflect":"الخادم يثق بأي موقع يطلب.","reflectcreds":"أي موقع يستطيع قراءة الصفحات كأنه زائرك المسجّل دخوله.","unknown":"تعذّر الفحص.","fix":"اسمح فقط بمواقع موثوقة محددة، ولا تعكس Origin مع Allow-Credentials: true."},"sri":{"n":"سلامة السكربتات الخارجية","pass":"السكربتات الخارجية مقفلة ببصمات integrity.","nothird":"لا توجد سكربتات خارجية في الصفحة الرئيسية.","warn":"سكربتات من مواقع أخرى بدون فحص integrity: {hosts}.","fix":"أضف integrity=\"sha384-…\" crossorigin لوسوم <script> الخارجية، أو استضفها بنفسك."},"libs":{"n":"مكتبات JavaScript قديمة","info":"لا تظهر إصدارات مكتبات معروفة في الصفحة.","found":"ظهر: {libs}. لا إصدارات قديمة معروفة.","fail":"إصدارات قديمة فيها ثغرات معلنة: {libs}.","fix":"حدّث هذه المكتبات لآخر إصدار."},"infoleak":{"n":"ترويسات التصحيح والخوادم الداخلية","pass":"لا توجد ترويسات تصحيح أو خوادم داخلية.","timing":"يرسل Server-Timing (يكشف أوقاتاً داخلية). غالباً غير ضار.","warn":"يكشف تفاصيل داخلية: {headers}.","fix":"احذف ترويسات التصحيح والخوادم الخلفية في بيئة الإنتاج."},"cookie_prefix":{"n":"بادئات الكوكيز","pass":"بادئات الكوكيز سليمة.","broken":"قواعد البادئة مكسورة: {names}.","suggest":"كوكيز الجلسة يمكنها استخدام البادئة __Host-‏: {names}.","nocookies":"لا توجد كوكيز لفحصها.","fix":"كوكيز __Host- تحتاج Secure وPath=/ وبدون Domain؛ وكوكيز __Secure- تحتاج Secure."},"spf_lookups":{"n":"حد استعلامات SPF","pass":"يستخدم {count} من 10 استعلامات DNS مسموحة.","ptr":"يستخدم قاعدة 'ptr' البطيئة وغير المستحسنة.","fail":"يحتاج {count} استعلام DNS؛ أكثر من 10 يعني أن SPF يتعطّل.","nospf":"يحتاج سجل SPF واحداً أولاً.","fix":"احذف إدخالات include: غير المستخدمة أو اختصرها لتبقى تحت 10."},"dmarc_details":{"n":"تقارير DMARC وتغطيته","pass":"يرسل تقارير (rua)، يغطي 100%، النطاقات الفرعية: {sp}.","warn":"نقاط ضعف: {missing}.","nodmarc":"يحتاج DMARC أولاً.","fix":"أضف rua=mailto:…، وأبقِ pct=100، ولا تضبط sp=none."},"mta_sts":{"n":"MTA-STS (بريد وارد مشفّر)","pass":"خوادم البريد مُلزَمة بالتشفير للوصول إليك (enforce).","testing":"السياسة في وضع '{mode}' وليست مفروضة بعد.","nopolicy":"سجل TXT موجود لكن ملف السياسة ناقص أو معطوب.","warn":"غير مضبوط: قد يُرسل البريد إليك بدون تشفير.","nomail":"لا يوجد بريد على هذا النطاق.","fix":"انشر TXT ‏_mta-sts والملف https://mta-sts.<domain>/.well-known/mta-sts.txt مع mode: enforce."},"tlsrpt":{"n":"TLS-RPT (تقارير تسليم البريد)","pass":"تصلك تقارير عند فشل تسليم البريد المشفّر.","info":"لا يوجد سجل TLS-RPT. اختياري.","fix":""},"bimi":{"n":"BIMI (الشعار في البريد)","pass":"يوجد سجل BIMI.","info":"لا يوجد سجل BIMI. اختياري، ويحتاج DMARC مفروضاً.","fix":""},"dnssec":{"n":"DNSSEC","pass":"إجابات DNS موقّعة، فيصعب تزويرها.","warn":"إجابات DNS غير موقّعة.","fix":"فعّل DNSSEC عند مزوّد DNS وأضف سجل DS عند المسجّل."},"caa":{"n":"CAA (من يصدر شهاداتك)","pass":"محصور في: {records}.","warn":"أي جهة شهادات تستطيع إصدار شهادة لنطاقك.","fix":"أضف سجلات CAA تسمّي فقط جهات الشهادات التي تستخدمها."},"caa_iodef":{"n":"تنبيهات CAA ‏(iodef)","pass":"سيتم إبلاغك بطلبات الشهادات المرفوضة.","info":"لا يوجد عنوان iodef في CAA. اختياري.","nocaa":"يحتاج CAA أولاً.","fix":""},"ipv6":{"n":"IPv6","pass":"يمكن الوصول عبر IPv6.","info":"لا يوجد عنوان IPv6. اختياري.","fix":""},"http2":{"n":"HTTP/2 وHTTP/3","pass":"يدعم {protos} (تحميل أسرع).","info":"فقط {protos}. تفعيل HTTP/2 يجعل الصفحات أسرع.","fix":""},"robots":{"n":"robots.txt وخريطة الموقع","pass":"كلاهما موجود.","info":"robots.txt: {robots} · sitemap: {sitemap}. مفيد لمحركات البحث، لا للأمان.","fix":""},"www":{"n":"مع www أو بدونها","pass":"{twin} و{main} يصلان لنفس العنوان.","warn":"{twin} يصل إلى {lands} وليس {main}.","broken":"{twin} موجود لكنه لا يعمل عبر HTTPS.","notwin":"{twin} غير مضبوط. لا بأس.","skipped":"{twin} يشير لمكان لن نفحصه.","fix":"حوّل نسخة (مثل www) إلى الأخرى بتحويل 301."}}}}