![\"Sam](\"/_next/image?url=%2Fsamhogan.jpg&w=64&q=75\"/)
![\"How](\"/_next/image?url=%2Fsearchable-how-to-get-your-product-listed-in-chatgpt-6.png&w=2048&q=75\"/)
![\"ChatGPT\"](\"/chatgpt-icon.svg\"/){kind=icon}
![\"Claude\"](\"/claude-icon.svg\"/){kind=icon}
![\"Google](\"/google-icon.svg\"/){kind=icon}
"Find me wireless headphones under $200 for working out."
\nWhen users ask ChatGPT questions like this, they now get visual product carousels with real products, prices, and direct purchase links. This isn't theoretical. ChatGPT Shopping is live and driving real sales for e-commerce brands who know how to optimize for it.
\nIf your products aren't showing up in these AI-powered recommendations, you're missing out on a massive opportunity. ChatGPT processes over 100 million queries daily, and shopping-related queries are growing 40% month-over-month.
\nThe good news? Getting listed in ChatGPT Shopping isn't about having the biggest marketing budget. It's about having the right technical setup and product optimization. This guide shows you exactly how to do it.
\n\n
How ChatGPT Shopping Actually Works
\nBefore diving into optimization, it's crucial to understand how ChatGPT selects and displays products:
\nThe ChatGPT Shopping Process:
\n- \n
- Intent Recognition: ChatGPT identifies shopping intent in queries like "best laptop for students" or "gift ideas for coffee lovers" \n
- Data Gathering: The system pulls structured product data from multiple sources including merchant websites, product feeds, and third-party platforms \n
- AI Analysis: ChatGPT analyzes price, reviews, features, and relevance to match user needs \n
- Carousel Generation: Products appear in visual carousels with AI-generated descriptions, pricing, and purchase links \n
- User Interaction: Users can click products for more details or ask follow-up questions \n
Key Difference from Traditional Search:
\n- \n
- No paid placements: ChatGPT Shopping results are purely organic \n
- Context matters more than keywords: Natural language queries get better matches \n
- Quality over quantity: Well-structured product data beats SEO tricks \n
\n
Step 1: Enable OpenAI's Web Crawler (OAI-SearchBot)
\nThis is the foundation. If ChatGPT can't crawl your site, your products will never appear.
\nCheck Your robots.txt File
\nNavigate to yourwebsite.com/robots.txt and ensure it doesn't block OAI-SearchBot.
Bad robots.txt (blocks ChatGPT):
\nUser-agent: *\nDisallow: /\n\nUser-agent: OAI-SearchBot\nDisallow: /\nGood robots.txt (allows ChatGPT):
\nUser-agent: OAI-SearchBot\nAllow: /\n\nUser-agent: *\nDisallow: /admin/\nDisallow: /cart/\nImplement llms.txt File (Optional but Recommended)
\nCreate an llms.txt file in your root directory to help AI systems understand your site structure:
# llms.txt - Help AI understand our site\n# Product pages\nhttps://yourstore.com/products/\nhttps://yourstore.com/categories/\n\n# Important pages\nhttps://yourstore.com/about/\nhttps://yourstore.com/reviews/\n\n# Avoid these pages\nDisallow: /admin/\nDisallow: /checkout/\nVerify Crawler Access
\nUse tools like:
\n- \n
- Screaming Frog: Check if OAI-SearchBot can access your pages \n
- robots.txt Tester: Validate your robots.txt configuration \n
- Server logs: Monitor for OAI-SearchBot visits (they'll start appearing within 48 hours) \n
\n
Step 2: Register as a ChatGPT Merchant
\nBefore providing product data, merchants must sign up at chatgpt.com/merchants.
\nOnce registered, follow OpenAI’s official documentation for setup and integration:
\n- \n
- Get Started: Integration overview and prerequisites \n
- Product Feed Spec: Field reference, formats, validation rules \n
- Checkout: Agentic checkout integration \n
- Payments: Delegated payment details \n
What to prepare:
\n- \n
- Accurate product catalog (IDs, titles, descriptions, links) \n
- Up-to-date pricing and availability \n
- Brand and media assets (images, video) \n
- Return policy and merchant info \n
\n
Step 3: Implement Comprehensive Product Schema Markup
\nSchema markup is your direct communication channel with ChatGPT's product understanding system.
\nEssential Product Schema Fields:
\n{\n "@context": "https://schema.org/",\n "@type": "Product",\n "name": "Ultra-Light Wireless Running Headphones",\n "description": "Sweat-resistant wireless earbuds designed for athletes with 8-hour battery life and secure-fit design",\n "image": [\n "https://yourstore.com/images/headphones-main.jpg",\n "https://yourstore.com/images/headphones-side.jpg"\n ],\n "brand": {\n "@type": "Brand",\n "name": "FitSound Pro"\n },\n "sku": "FSP-WH-001",\n "gtin": "123456789012",\n "offers": {\n "@type": "Offer",\n "url": "https://yourstore.com/products/wireless-headphones",\n "priceCurrency": "USD",\n "price": "149.99",\n "availability": "https://schema.org/InStock",\n "seller": {\n "@type": "Organization",\n "name": "Your Store Name"\n }\n },\n "aggregateRating": {\n "@type": "AggregateRating",\n "ratingValue": "4.7",\n "reviewCount": "342",\n "bestRating": "5",\n "worstRating": "1"\n },\n "review": [{\n "@type": "Review",\n "author": {\n "@type": "Person",\n "name": "Sarah M."\n },\n "reviewRating": {\n "@type": "Rating",\n "ratingValue": "5"\n },\n "reviewBody": "Perfect for my daily runs. Battery lasts through long workouts and they never fall out."\n }]\n}\nImplementation Methods:
\nFor Shopify:
\n- \n
- Use apps like "JSON-LD for SEO" or "Schema & Structured Data" \n
- Enable built-in product structured data in theme settings \n
For WooCommerce:
\n- \n
- Install "Schema Pro" or "Rank Math" plugins \n
- Add custom schema via theme functions.php \n
For Custom Sites:
\n- \n
- Add JSON-LD script tags to product pages \n
- Implement schema in HTML microdata format \n
Validation Steps:
\n- \n
- Google Rich Results Test: search.google.com/test/rich-results \n
- Schema.org Validator: validator.schema.org \n
- ChatGPT Schema Test: Ask ChatGPT to analyze your product page (it can read schema markup) \n
\n
OpenAI Product Feed: Required + Recommended Fields
\nOpenAI’s Product Feed powers indexing and ranking for ChatGPT Shopping. Start with the Required + Recommended fields below, then expand to the full spec as you mature. See the complete reference: Product Feed Spec.
\nRequired fields (core)
\n| Field | Type | Description | Example |
|---|---|---|---|
| enable_search | Enum (true/false) | Allow product to appear in ChatGPT search | true |
| enable_checkout | Enum (true/false) | Allow direct purchase in ChatGPT | true |
| id | String | Unique merchant product ID (stable) | SKU12345 |
| title | String | Product title (≤150 chars) | Wireless Running Headphones |
| description | String | Full description (≤5000 chars) | Sweat‑resistant wireless earbuds… |
| link | URL | Product detail page URL | https://example.com/product |
| price | String | Price with currency | 149.99 USD |
| availability | Enum | in_stock, out_of_stock, preorder | in_stock |
| image_link | URL | Main product image URL | https://example.com/img.jpg |
| product_category | String | Category taxonomy path | Electronics > Headphones |
| brand | String | Product brand | FitSound Pro |
| material | String | Primary materials | Aluminum |
| weight | String/number | Product weight with unit | 1.2 lb |
| seller_name | String | Seller/store name | Example Store |
| return_policy | URL | Return policy URL | https://example.com/returns |
Recommended fields (improves ranking/UX)
\n| Field | Type | Description | Example |
|---|---|---|---|
| gtin | String | Universal product identifier (8–14 digits) | 123456789543 |
| sale_price | String | Discounted price | 129.99 USD |
| additional_image_link | Array(URL) | Additional images | Multiple URLs |
| video_link | URL | Product video URL | https://example.com/demo.mp4 |
| color | String | Variant color | Blue |
| size | String | Variant size | Medium |
| popularity_score | Number | Popularity indicator (0–5) | 4.7 |
| product_review_count | Integer | Number of reviews | 254 |
| product_review_rating | Number | Avg rating (0–5) | 4.6 |
| related_product_id | String/Array | Associated product IDs | SKU67890 |
| geo_price | Object | Region‑specific pricing | 79.99 USD (CA) |
Feed delivery overview
\n| Topic | Details |
|---|---|
| Delivery model | Merchant pushes feed over HTTPS to allow‑listed endpoint |
| File formats | TSV, CSV, XML, JSON |
| Refresh frequency | Updates accepted every 15 minutes |
| Initial load | Sample or full feed for validation before live updates |
Want to validate your products now? Check your ChatGPT Shopping readiness for free.
\n\n
Step 4: Optimize Product Content for Natural Language Queries
\nChatGPT understands conversational queries differently than traditional search engines.
\nProduct Title Optimization:
\nTraditional SEO Title:\n"BT-WH-2024-PRO Bluetooth Wireless Headphones Sport"
\nChatGPT-Optimized Title:\n"Wireless Running Headphones - Sweat-Resistant with 8-Hour Battery"
\nDescription Best Practices:
\nAnswer the questions customers actually ask:
\nPerfect for active lifestyles, these wireless headphones deliver:\n\n- 8-hour battery life for all-day workouts\n- IPX7 sweat and rain resistance\n- Secure ear hooks that stay put during runs\n- Crystal-clear call quality for hands-free use\n- Quick 15-minute charge provides 2 hours of playtime\n\nIdeal for: Running, gym workouts, cycling, daily commutes\nCompatible with: iPhone, Android, tablets, laptops\nIncluded: Charging case, 3 ear tip sizes, USB-C cable\nFAQ Integration:
\nAdd FAQ sections that address common customer questions:
\n<div itemscope itemtype="https://schema.org/FAQPage">\n <div itemscope itemprop="mainEntity" itemtype="https://schema.org/Question">\n <h3 itemprop="name">Do these headphones stay in during intense workouts?</h3>\n <div itemscope itemprop="acceptedAnswer" itemtype="https://schema.org/Answer">\n <p itemprop="text">Yes, the secure-fit ear hooks and multiple ear tip sizes ensure they stay comfortably in place during running, jumping, and high-intensity training.</div>\n </div>\n </div>\n</div>\n\n
Step 5: Optimize Third-Party Platform Presence
\nChatGPT pulls data from multiple sources beyond your website.
\nPriority Platforms for Product Listings:
\n1. Amazon (Highest Priority)
\n- \n
- Create Amazon seller account if you don't have one \n
- Optimize product titles with natural language \n
- Encourage detailed customer reviews \n
- Use Amazon's Enhanced Brand Content (EBC) \n
2. Google Shopping/Merchant Center
\n- \n
- Submit comprehensive product feeds \n
- Include all required attributes (GTIN, MPN, condition) \n
- Keep inventory and pricing updated daily \n
3. Platform-Specific Optimizations:
\nShopify Plus Users:
\n- \n
- Enable "Shop" app integration \n
- Use Shopify's native product feed features \n
- Implement Shopify's product reviews app \n
WooCommerce:
\n- \n
- Install Google Listings & Ads plugin \n
- Set up Facebook Shop integration \n
- Use structured data plugins \n
Review Platform Strategy:
\nGet listed and optimized on:
\n- \n
- Trustpilot: Industry-standard review platform \n
- Google My Business: For local/retail presence \n
- Yelp: Service-based businesses \n
- Industry-specific: (Capterra for software, G2 for B2B tools, etc.) \n
\n
Step 6: Implement ChatGPT-Specific Tracking
\nMeasure your ChatGPT Shopping performance with proper analytics setup.
\nUTM Parameter Tracking:
\nChatGPT automatically adds utm_source=chatgpt.com to referral links. Set up:
Google Analytics 4:
\n- \n
- Create custom conversion events for ChatGPT traffic \n
- Set up attribution models including AI search sources \n
- Create custom reports for AI-driven sales \n
Sample GA4 Custom Event:
\ngtag('event', 'chatgpt_product_view', {\n 'custom_parameter_1': 'product_name',\n 'custom_parameter_2': 'product_category',\n 'value': 149.99,\n 'currency': 'USD'\n});\nShopify Tracking Setup:
\n// Add to theme.liquid before closing </head>\n{% if request.headers['Referer'] contains 'chatgpt.com' %}\n <script>\n gtag('event', 'chatgpt_referral', {\n 'event_category': 'AI Search',\n 'event_label': 'ChatGPT Shopping'\n });\n </script>\n{% endif",
"otherinfo": ""
}
],
"count": "1",
"systemic": false,
"solution": "Ensure that application Source Code is not available with alternative extensions, and ensure that source code is not present within other files or data deployed to the web server, or served by the web server.
",
"otherinfo": "",
"reference": "https://nhimg.org/twitter-breach
",
"cweid": "540",
"wascid": "13",
"sourceid": "2483"
}
},
{
"tool": "zap",
"type": "web",
"severity": "medium",
"title": "Source Code Disclosure - SQL",
"description": "Application Source Code was disclosed by the web server. - SQL
",
"endpoint": null,
"raw": {
"pluginid": "10099",
"alertRef": "10099",
"alert": "Source Code Disclosure - SQL",
"name": "Source Code Disclosure - SQL",
"riskcode": "2",
"confidence": "2",
"riskdesc": "Medium (Medium)",
"desc": "Application Source Code was disclosed by the web server. - SQL
",
"instances": [
{
"id": "133",
"uri": "https://www.searchable.com/blog/increase-ai-search-citations",
"nodeName": "https://www.searchable.com/blog/increase-ai-search-citations",
"method": "GET",
"param": "",
"attack": "",
"evidence": "select sources. With each platform pulling from different pools, such as ChatGPT from authoritative publications, Perplexity from Reddit and YouTube, and Google AI Overviews from its own index, understanding these differences is the first step to structuring content that each platform will actually cite.",
"otherinfo": ""
}
],
"count": "1",
"systemic": false,
"solution": "Ensure that application Source Code is not available with alternative extensions, and ensure that source code is not present within other files or data deployed to the web server, or served by the web server.
",
"otherinfo": "",
"reference": "https://nhimg.org/twitter-breach
",
"cweid": "540",
"wascid": "13",
"sourceid": "1855"
}
},
{
"tool": "zap",
"type": "web",
"severity": "medium",
"title": "Sub Resource Integrity Attribute Missing",
"description": "The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content.
",
"endpoint": null,
"raw": {
"pluginid": "90003",
"alertRef": "90003",
"alert": "Sub Resource Integrity Attribute Missing",
"name": "Sub Resource Integrity Attribute Missing",
"riskcode": "2",
"confidence": "3",
"riskdesc": "Medium (High)",
"desc": "The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content.
",
"instances": [
{
"id": "36",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "37",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "39",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "40",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "48",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
}
],
"count": "5",
"systemic": true,
"solution": "Provide a valid integrity attribute to the tag.
",
"otherinfo": "",
"reference": "https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity
",
"cweid": "345",
"wascid": "15",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "Cookie No HttpOnly Flag",
"description": "A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.
",
"endpoint": null,
"raw": {
"pluginid": "10010",
"alertRef": "10010",
"alert": "Cookie No HttpOnly Flag",
"name": "Cookie No HttpOnly Flag",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.
",
"instances": [
{
"id": "19",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
},
{
"id": "139",
"uri": "https://www.searchable.com/de",
"nodeName": "https://www.searchable.com/de",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
},
{
"id": "135",
"uri": "https://www.searchable.com/es",
"nodeName": "https://www.searchable.com/es",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
},
{
"id": "137",
"uri": "https://www.searchable.com/fr",
"nodeName": "https://www.searchable.com/fr",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
},
{
"id": "141",
"uri": "https://www.searchable.com/pt",
"nodeName": "https://www.searchable.com/pt",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
}
],
"count": "5",
"systemic": true,
"solution": "Ensure that the HttpOnly flag is set for all cookies.
",
"otherinfo": "",
"reference": "https://owasp.org/www-community/HttpOnly
",
"cweid": "1004",
"wascid": "13",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "Cookie Without Secure Flag",
"description": "A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.
",
"endpoint": null,
"raw": {
"pluginid": "10011",
"alertRef": "10011",
"alert": "Cookie Without Secure Flag",
"name": "Cookie Without Secure Flag",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.
",
"instances": [
{
"id": "20",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
},
{
"id": "140",
"uri": "https://www.searchable.com/de",
"nodeName": "https://www.searchable.com/de",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
},
{
"id": "136",
"uri": "https://www.searchable.com/es",
"nodeName": "https://www.searchable.com/es",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
},
{
"id": "138",
"uri": "https://www.searchable.com/fr",
"nodeName": "https://www.searchable.com/fr",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
},
{
"id": "142",
"uri": "https://www.searchable.com/pt",
"nodeName": "https://www.searchable.com/pt",
"method": "GET",
"param": "NEXT_LOCALE",
"attack": "",
"evidence": "Set-Cookie: NEXT_LOCALE",
"otherinfo": ""
}
],
"count": "5",
"systemic": true,
"solution": "Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted channel. Ensure that the secure flag is set for cookies containing such sensitive information.
",
"otherinfo": "",
"reference": "https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes.html
",
"cweid": "614",
"wascid": "13",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "Cross-Domain JavaScript Source File Inclusion",
"description": "The page includes one or more script files from a third-party domain.
",
"endpoint": null,
"raw": {
"pluginid": "10017",
"alertRef": "10017",
"alert": "Cross-Domain JavaScript Source File Inclusion",
"name": "Cross-Domain JavaScript Source File Inclusion",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "The page includes one or more script files from a third-party domain.
",
"instances": [
{
"id": "22",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "https://api.leadpipe.com/cs?apiKey=55c17ad2-c767-470d-9848-6a091a1dd23a",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "74",
"uri": "https://www.searchable.com/_next/data",
"nodeName": "https://www.searchable.com/_next/data",
"method": "GET",
"param": "https://api.leadpipe.com/cs?apiKey=55c17ad2-c767-470d-9848-6a091a1dd23a",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "26",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "https://api.leadpipe.com/cs?apiKey=55c17ad2-c767-470d-9848-6a091a1dd23a",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "32",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "https://api.leadpipe.com/cs?apiKey=55c17ad2-c767-470d-9848-6a091a1dd23a",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "76",
"uri": "https://www.searchable.com/private",
"nodeName": "https://www.searchable.com/private",
"method": "GET",
"param": "https://api.leadpipe.com/cs?apiKey=55c17ad2-c767-470d-9848-6a091a1dd23a",
"attack": "",
"evidence": "",
"otherinfo": ""
}
],
"count": "5",
"systemic": true,
"solution": "Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
",
"otherinfo": "",
"reference": "",
"cweid": "829",
"wascid": "15",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "Cross-Origin-Embedder-Policy Header Missing or Invalid",
"description": "Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
",
"endpoint": null,
"raw": {
"pluginid": "90004",
"alertRef": "90004-2",
"alert": "Cross-Origin-Embedder-Policy Header Missing or Invalid",
"name": "Cross-Origin-Embedder-Policy Header Missing or Invalid",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
",
"instances": [
{
"id": "55",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "Cross-Origin-Embedder-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "63",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "Cross-Origin-Embedder-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "71",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "Cross-Origin-Embedder-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "9",
"uri": "https://www.searchable.com/sitemap.xml",
"nodeName": "https://www.searchable.com/sitemap.xml",
"method": "GET",
"param": "Cross-Origin-Embedder-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
}
],
"count": "4",
"systemic": false,
"solution": "Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).
",
"otherinfo": "",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
",
"cweid": "693",
"wascid": "14",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "Cross-Origin-Opener-Policy Header Missing or Invalid",
"description": "Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.
",
"endpoint": null,
"raw": {
"pluginid": "90004",
"alertRef": "90004-3",
"alert": "Cross-Origin-Opener-Policy Header Missing or Invalid",
"name": "Cross-Origin-Opener-Policy Header Missing or Invalid",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.
",
"instances": [
{
"id": "56",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "Cross-Origin-Opener-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "64",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "Cross-Origin-Opener-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "72",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "Cross-Origin-Opener-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "10",
"uri": "https://www.searchable.com/sitemap.xml",
"nodeName": "https://www.searchable.com/sitemap.xml",
"method": "GET",
"param": "Cross-Origin-Opener-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
}
],
"count": "4",
"systemic": false,
"solution": "Ensure that the application/web server sets the Cross-Origin-Opener-Policy header appropriately, and that it sets the Cross-Origin-Opener-Policy header to 'same-origin' for documents.
'same-origin-allow-popups' is considered as less secured and should be avoided.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Opener-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-opener-policy).
",
"otherinfo": "",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
",
"cweid": "693",
"wascid": "14",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "Cross-Origin-Resource-Policy Header Missing or Invalid",
"description": "Cross-Origin-Resource-Policy header is an opt-in header designed to counter side-channels attacks like Spectre. Resource should be specifically set as shareable amongst different origins.
",
"endpoint": null,
"raw": {
"pluginid": "90004",
"alertRef": "90004-1",
"alert": "Cross-Origin-Resource-Policy Header Missing or Invalid",
"name": "Cross-Origin-Resource-Policy Header Missing or Invalid",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "Cross-Origin-Resource-Policy header is an opt-in header designed to counter side-channels attacks like Spectre. Resource should be specifically set as shareable amongst different origins.
",
"instances": [
{
"id": "54",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "Cross-Origin-Resource-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "62",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "Cross-Origin-Resource-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "70",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "Cross-Origin-Resource-Policy",
"attack": "",
"evidence": "",
"otherinfo": ""
}
],
"count": "3",
"systemic": false,
"solution": "Ensure that the application/web server sets the Cross-Origin-Resource-Policy header appropriately, and that it sets the Cross-Origin-Resource-Policy header to 'same-origin' for all web pages.
'same-site' is considered as less secured and should be avoided.
If resources must be shared, set the header to 'cross-origin'.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Resource-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-resource-policy).
",
"otherinfo": "",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
",
"cweid": "693",
"wascid": "14",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "Permissions Policy Header Not Set",
"description": "Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.
",
"endpoint": null,
"raw": {
"pluginid": "10063",
"alertRef": "10063-1",
"alert": "Permissions Policy Header Not Set",
"name": "Permissions Policy Header Not Set",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.
",
"instances": [
{
"id": "53",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "91",
"uri": "https://www.searchable.com/_next/data",
"nodeName": "https://www.searchable.com/_next/data",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "61",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "69",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
},
{
"id": "90",
"uri": "https://www.searchable.com/private",
"nodeName": "https://www.searchable.com/private",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": ""
}
],
"count": "5",
"systemic": true,
"solution": "Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header.
",
"otherinfo": "",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
https://developer.chrome.com/blog/feature-policy/
https://scotthelme.co.uk/a-new-security-header-feature-policy/
https://w3c.github.io/webappsec-feature-policy/
https://www.smashingmagazine.com/2018/12/feature-policy/
",
"cweid": "693",
"wascid": "15",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "Secure Pages Include Mixed Content",
"description": "The page includes mixed content, that is content accessed via HTTP instead of HTTPS.
",
"endpoint": null,
"raw": {
"pluginid": "10040",
"alertRef": "10040",
"alert": "Secure Pages Include Mixed Content",
"name": "Secure Pages Include Mixed Content",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "The page includes mixed content, that is content accessed via HTTP instead of HTTPS.
",
"instances": [
{
"id": "130",
"uri": "https://www.searchable.com/chatgpt-product-visibility-report",
"nodeName": "https://www.searchable.com/chatgpt-product-visibility-report",
"method": "GET",
"param": "",
"attack": "",
"evidence": "http://www.heights.com/cdn/shop/files/vitals_-_new_600x.png",
"otherinfo": "tag=img src=http://www.heights.com/cdn/shop/files/vitals_-_new_600x.png\ntag=img src=http://www.heights.com/cdn/shop/files/vitals_-_new_600x.png\n"
}
],
"count": "1",
"systemic": false,
"solution": "A page that is available over SSL/TLS must be comprised completely of content which is transmitted over SSL/TLS.
The page must not contain any content that is transmitted over unencrypted HTTP.
This includes content from third party sites.
",
"otherinfo": "tag=img src=http://www.heights.com/cdn/shop/files/vitals_-_new_600x.png
tag=img src=http://www.heights.com/cdn/shop/files/vitals_-_new_600x.png
",
"reference": "https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html
",
"cweid": "311",
"wascid": "4",
"sourceid": "664"
}
},
{
"tool": "zap",
"type": "web",
"severity": "low",
"title": "X-Content-Type-Options Header Missing",
"description": "The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
",
"endpoint": null,
"raw": {
"pluginid": "10021",
"alertRef": "10021",
"alert": "X-Content-Type-Options Header Missing",
"name": "X-Content-Type-Options Header Missing",
"riskcode": "1",
"confidence": "2",
"riskdesc": "Low (Medium)",
"desc": "The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
",
"instances": [
{
"id": "41",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "x-content-type-options",
"attack": "",
"evidence": "",
"otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses."
},
{
"id": "45",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "x-content-type-options",
"attack": "",
"evidence": "",
"otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses."
},
{
"id": "57",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "x-content-type-options",
"attack": "",
"evidence": "",
"otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses."
},
{
"id": "3",
"uri": "https://www.searchable.com/robots.txt",
"nodeName": "https://www.searchable.com/robots.txt",
"method": "GET",
"param": "x-content-type-options",
"attack": "",
"evidence": "",
"otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses."
},
{
"id": "7",
"uri": "https://www.searchable.com/sitemap.xml",
"nodeName": "https://www.searchable.com/sitemap.xml",
"method": "GET",
"param": "x-content-type-options",
"attack": "",
"evidence": "",
"otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses."
}
],
"count": "5",
"systemic": true,
"solution": "Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.
If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
",
"otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.
At \"High\" threshold this scan rule will not alert on client or server error responses.
",
"reference": "https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)
https://owasp.org/www-community/Security_Headers
",
"cweid": "693",
"wascid": "15",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "informational",
"title": "Modern Web Application",
"description": "The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
",
"endpoint": null,
"raw": {
"pluginid": "10109",
"alertRef": "10109",
"alert": "Modern Web Application",
"name": "Modern Web Application",
"riskcode": "0",
"confidence": "2",
"riskdesc": "Informational (Medium)",
"desc": "The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
",
"instances": [
{
"id": "33",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": "A noScript tag has been found, which is an indication that the application works differently with JavaScript enabled compared to when it is not."
},
{
"id": "79",
"uri": "https://www.searchable.com/_next/data",
"nodeName": "https://www.searchable.com/_next/data",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": "A noScript tag has been found, which is an indication that the application works differently with JavaScript enabled compared to when it is not."
},
{
"id": "34",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application."
},
{
"id": "44",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application."
},
{
"id": "80",
"uri": "https://www.searchable.com/private",
"nodeName": "https://www.searchable.com/private",
"method": "GET",
"param": "",
"attack": "",
"evidence": "",
"otherinfo": "A noScript tag has been found, which is an indication that the application works differently with JavaScript enabled compared to when it is not."
}
],
"count": "5",
"systemic": true,
"solution": "This is an informational alert and so no changes are required.
",
"otherinfo": "A noScript tag has been found, which is an indication that the application works differently with JavaScript enabled compared to when it is not.
",
"reference": "",
"cweid": "-1",
"wascid": "-1",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "informational",
"title": "Non-Storable Content",
"description": "The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.
",
"endpoint": null,
"raw": {
"pluginid": "10049",
"alertRef": "10049-1",
"alert": "Non-Storable Content",
"name": "Non-Storable Content",
"riskcode": "0",
"confidence": "2",
"riskdesc": "Informational (Medium)",
"desc": "The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.
",
"instances": [
{
"id": "42",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "no-store",
"otherinfo": ""
},
{
"id": "46",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "",
"attack": "",
"evidence": "no-store",
"otherinfo": ""
},
{
"id": "58",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "",
"attack": "",
"evidence": "no-store",
"otherinfo": ""
},
{
"id": "89",
"uri": "https://www.searchable.com/private",
"nodeName": "https://www.searchable.com/private",
"method": "GET",
"param": "",
"attack": "",
"evidence": "no-store",
"otherinfo": ""
}
],
"count": "4",
"systemic": false,
"solution": "The content may be marked as storable by ensuring that the following conditions are satisfied:
The request method must be understood by the cache and defined as being cacheable (\"GET\", \"HEAD\", and \"POST\" are currently defined as cacheable)
The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)
The \"no-store\" cache directive must not appear in the request or response header fields
For caching by \"shared\" caches such as \"proxy\" caches, the \"private\" response directive must not appear in the response
For caching by \"shared\" caches such as \"proxy\" caches, the \"Authorization\" header field must not appear in the request, unless the response explicitly allows it (using one of the \"must-revalidate\", \"public\", or \"s-maxage\" Cache-Control response directives)
In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:
It must contain an \"Expires\" header field
It must contain a \"max-age\" response directive
For \"shared\" caches such as \"proxy\" caches, it must contain a \"s-maxage\" response directive
It must contain a \"Cache Control Extension\" that allows it to be cached
It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).
",
"otherinfo": "",
"reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
",
"cweid": "524",
"wascid": "13",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "informational",
"title": "Re-examine Cache-control Directives",
"description": "The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.
",
"endpoint": null,
"raw": {
"pluginid": "10015",
"alertRef": "10015",
"alert": "Re-examine Cache-control Directives",
"name": "Re-examine Cache-control Directives",
"riskcode": "0",
"confidence": "1",
"riskdesc": "Informational (Low)",
"desc": "The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.
",
"instances": [
{
"id": "131",
"uri": "https://www.searchable.com/llms.txt",
"nodeName": "https://www.searchable.com/llms.txt",
"method": "GET",
"param": "cache-control",
"attack": "",
"evidence": "public, max-age=0, must-revalidate",
"otherinfo": ""
},
{
"id": "0",
"uri": "https://www.searchable.com/robots.txt",
"nodeName": "https://www.searchable.com/robots.txt",
"method": "GET",
"param": "cache-control",
"attack": "",
"evidence": "public, max-age=0, must-revalidate",
"otherinfo": ""
},
{
"id": "4",
"uri": "https://www.searchable.com/sitemap.xml",
"nodeName": "https://www.searchable.com/sitemap.xml",
"method": "GET",
"param": "cache-control",
"attack": "",
"evidence": "public, max-age=0, must-revalidate",
"otherinfo": ""
}
],
"count": "3",
"systemic": false,
"solution": "For secure content, ensure the cache-control HTTP header is set with \"no-cache, no-store, must-revalidate\". If an asset should be cached consider setting the directives \"public, max-age, immutable\".
",
"otherinfo": "",
"reference": "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control
https://grayduck.mn/2021/09/13/cache-control-recommendations/
",
"cweid": "525",
"wascid": "13",
"sourceid": "1293"
}
},
{
"tool": "zap",
"type": "web",
"severity": "informational",
"title": "Retrieved from Cache",
"description": "The content was retrieved from a shared cache. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
",
"endpoint": null,
"raw": {
"pluginid": "10050",
"alertRef": "10050-2",
"alert": "Retrieved from Cache",
"name": "Retrieved from Cache",
"riskcode": "0",
"confidence": "2",
"riskdesc": "Informational (Medium)",
"desc": "The content was retrieved from a shared cache. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
",
"instances": [
{
"id": "35",
"uri": "https://www.searchable.com/",
"nodeName": "https://www.searchable.com/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "Age: 0",
"otherinfo": "The presence of the 'Age' header indicates that a HTTP/1.1 compliant caching server is in use."
},
{
"id": "38",
"uri": "https://www.searchable.com/api",
"nodeName": "https://www.searchable.com/api",
"method": "GET",
"param": "",
"attack": "",
"evidence": "Age: 0",
"otherinfo": "The presence of the 'Age' header indicates that a HTTP/1.1 compliant caching server is in use."
},
{
"id": "47",
"uri": "https://www.searchable.com/for",
"nodeName": "https://www.searchable.com/for",
"method": "GET",
"param": "",
"attack": "",
"evidence": "Age: 0",
"otherinfo": "The presence of the 'Age' header indicates that a HTTP/1.1 compliant caching server is in use."
},
{
"id": "2",
"uri": "https://www.searchable.com/robots.txt",
"nodeName": "https://www.searchable.com/robots.txt",
"method": "GET",
"param": "",
"attack": "",
"evidence": "Age: 17326",
"otherinfo": "The presence of the 'Age' header indicates that a HTTP/1.1 compliant caching server is in use."
},
{
"id": "6",
"uri": "https://www.searchable.com/sitemap.xml",
"nodeName": "https://www.searchable.com/sitemap.xml",
"method": "GET",
"param": "",
"attack": "",
"evidence": "Age: 17666",
"otherinfo": "The presence of the 'Age' header indicates that a HTTP/1.1 compliant caching server is in use."
}
],
"count": "5",
"systemic": true,
"solution": "Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
Expires: 0
This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
",
"otherinfo": "The presence of the 'Age' header indicates that a HTTP/1.1 compliant caching server is in use.
",
"reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.rfc-editor.org/rfc/rfc9110.html
",
"cweid": "525",
"wascid": "-1",
"sourceid": "1"
}
},
{
"tool": "zap",
"type": "web",
"severity": "informational",
"title": "Storable but Non-Cacheable Content",
"description": "The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
",
"endpoint": null,
"raw": {
"pluginid": "10049",
"alertRef": "10049-2",
"alert": "Storable but Non-Cacheable Content",
"name": "Storable but Non-Cacheable Content",
"riskcode": "0",
"confidence": "2",
"riskdesc": "Informational (Medium)",
"desc": "The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
",
"instances": [
{
"id": "13",
"uri": "https://www.searchable.com/_next/data/",
"nodeName": "https://www.searchable.com/_next/data/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "max-age=0",
"otherinfo": ""
},
{
"id": "12",
"uri": "https://www.searchable.com/admin/",
"nodeName": "https://www.searchable.com/admin/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "max-age=0",
"otherinfo": ""
},
{
"id": "11",
"uri": "https://www.searchable.com/for/",
"nodeName": "https://www.searchable.com/for/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "max-age=0",
"otherinfo": ""
},
{
"id": "14",
"uri": "https://www.searchable.com/private/",
"nodeName": "https://www.searchable.com/private/",
"method": "GET",
"param": "",
"attack": "",
"evidence": "max-age=0",
"otherinfo": ""
},
{
"id": "8",
"uri": "https://www.searchable.com/sitemap.xml",
"nodeName": "https://www.searchable.com/sitemap.xml",
"method": "GET",
"param": "",
"attack": "",
"evidence": "max-age=0",
"otherinfo": ""
}
],
"count": "5",
"systemic": true,
"solution": "",
"otherinfo": "",
"reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
",
"cweid": "524",
"wascid": "13",
"sourceid": "22"
}
}
],
"warnings": [
"worker_security.py / subfinder: 0 findings — no subdomains or lookup blocked; continuing",
"worker_security.py / nuclei: 0 findings after 586s (limit 1200s) — site may block automated scans, need longer SCAN_NUCLEI_TIMEOUT, or no critical/high/medium templates matched"
],
"target_name": "Searchable"
}