Security Of The Alexa Top Sites


The Alexa Top Websites ( can be used to monitor the popularity trend of a website and compare the popularity of different websites (WikiPedia).

In order to gauge the security posture of the internet as a whole mapping information from the Alexa Top Sites is useful. assists by building a PostgreSQL database that stores header information from each website, the first listed resolved IP address, HTTP response code, and MX records. The header information also includes cookies that are passed during an initial connection. This approach was used to examine security of the Alexa Top Websites in a research paper CookiExt: Patching the Browser Against Session Hijacking Attacks. can also accept a list of other domains you want to check for forced TLS encryption and inspect cookies and other header information.

Specific HTTP Security Risks

SSL/TLS Enforcement

The Alexa Check database allows analysis of a particular website for security. For example if a site does not enforce encryption for user connections. This can be identified by a site returning a 200 OK response code for an insecure connection such as reveals that the site does not strictly force transport layer security (SSL/TLS). This means the site is susceptible to a MiTM (man in the middle) attack. If these sites offer user accounts and use the PHP session cookies as its only means to maintain state of the user’s device a session hijacking attack is possible.

Mitigating MiTM attacks can be done by forwarding any requests for http:// to https:// port 443. Of course you must have a certificate for your domain issued by a certificate authority but those are available for free from The Electronic Frontier Foundation’s (EFF) Let’s Encrypt (, which can be installed easily using certbot, and set to automatically renew with a cron. In fact, using certbot will also automatically configure the webserver to forward http:// traffic to https://, although you will also want to forward any direct requests for the IP address itself to the domain.

Create TLS Certificate Linux Apache Servers with Let’s Encrypt Certbot:

Other Security Headers

The headers of a website can also provide other security related information such as X-Frame-Options settings, HTTP-Only and Secure cookie flags, x-xss-protection setting, and more. HTTP-Only and Secure cookie flags determine whether cookies are passed over insecure http connections and whether those cookies are available via JavaScript. By configuring a web server to restrict cookies from being read in JavaScript, a website can protect users from having their cookies read by a browser plugin, or by an Cross Site Scripting (XSS) attack. x-xss-protection header is a feature of Internet Explorer, Chrome and Safari that gives the user’s browser explicit instructions to now allow <script> tags in any of its URLS. This adds some protection to XSS attacks that target the URL, mitigating any inability to handle XSS on the server side. There are even more security headers, and if you want to know more I suggest checking out Scott Helme’s informative website ( because he seems to be the most knowledgable person on the internet regarding security headers.

Example of a HTTP Header with Some Security Headers Set


[1] The HTTPS-Only Standard

[2] How widely used are security based HTTP response headers?

[3] Hardening your HTTP response headers

[4] Want to Encrypt All The Things? Firefox has you covered with HTTPS-Only Mode!

[5] Security Headers Updates

[6] CookiExt: Patching the Browser Against Session Hijacking Attacks, Journal of Computer Security (2015)

Leave a comment

Your email address will not be published.


This site uses Akismet to reduce spam. Learn how your comment data is processed.