# Security warnings

> Security warnings are messages the browser writes to its console when it finds a security problem on a page, such as a blocked resource or an invalid policy.

- **Check ID:** SEC9
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/security-warnings

## Why it matters

Security warnings in the console signal potential vulnerabilities that an attacker can exploit. Ignoring warnings can lead to data leaks, unauthorized access, or compromise of the entire application. A clean console is a sign of a well-secured website.

## In practice

A website with a form on an HTTP page displays a warning in Chrome about an insecure form target. Cloudflare.com has a clean console with no security warnings, which indicates thorough security across all parts of the website.

## How be1st checks it

Checks whether security warnings appear in the browser console, such as missing security headers, invalid certificates, outdated TLS versions, insecure forms, or CORS policy issues.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [Security on the web](https://developer.mozilla.org/en-US/docs/Web/Security) (MDN)
- [OWASP Secure Headers Project](https://owasp.org/projects/secure-headers-project) (OWASP)

## Related terms

- [Insecure cookies](https://be1st.ai/glossary/security/insecure-cookies): An insecure cookie is a cookie set without the Secure, HttpOnly or SameSite attribute, which leaves it open to theft or misuse by other sites.
- [Deprecated APIs](https://be1st.ai/glossary/security/deprecated-apis): Deprecated APIs are browser features that are being phased out. Code that still uses them can stop working once browsers remove them.
- [HTTPS (security)](https://be1st.ai/glossary/security/https): HTTPS is HTTP encrypted with TLS. It keeps passwords, forms and cookies private on the way between the visitor and the server.
- [Strict-Transport-Security (HSTS)](https://be1st.ai/glossary/security/strict-transport-security-hsts): Strict-Transport-Security (HSTS) is an HTTP header that tells browsers to use a website only over HTTPS for a set time, even when someone types or links http://.
- [Content-Security-Policy (CSP)](https://be1st.ai/glossary/security/content-security-policy-csp): Content-Security-Policy (CSP) is an HTTP header that lists the sources a page may load scripts, styles, images and frames from. It is the main defence against XSS.
- [X-Frame-Options](https://be1st.ai/glossary/security/x-frame-options): X-Frame-Options is an HTTP header that decides whether other websites may embed your page in a frame. It protects visitors against clickjacking.