New check
34Dangerous
SUS

this is sus — proceed with caution

Final verdict: Not Valid

Something here raised some red flags. Hold off on using it, and do not click anything inside it.

URLOct 25, 2026 • 00:34
Share this verdict
6
good
3
warning
1
bad

Scan coverage

http://www.readanybook.com/ • 10/25/2026, 12:34:39 AM • HTTP 403

✓ Static HTML: completed✓ Security Headers: completed✓ Redirect Inspection: completed✓ Tracker Detection: completed⚠ Privacy Policy: not found⚠ Terms of Service: not found○ Browser Behavior: unavailable
Risk vectors & defense depthConfidence: 96% · Zero-trust baseline
Transport & TLS60%
Vulnerable
Content & Scripts100%
Clean
Telemetry Surface100%
Minimal
Legal Governance86%
Deficient

Key security observations

TransportConnection is unencrypted HTTP; traffic can be read or altered in transit
Forms & InputNo credential or password input fields detected on page
TelemetryZero third-party trackers or advertising beacons detected
GovernanceNo privacy policy or terms of service documentation found
GuidanceSomething here raised some red flags. Hold off on using it, and do not click anything inside it.

Actions that would improve score

Migrate entire site transport to HTTPS with TLS 1.3+33 pts
Deploy Content-Security-Policy with strict script-src and frame-ancestors+7 pts
Publish formal Privacy Policy and Terms of Service documents+14 pts

How the score was calculated

Baseline50
Good findings (6)+50
Warnings & issues (4)-66
Final score34/100 · SUS
badSecurity· HTTP Response
-33 pts → 17

Unencrypted HTTP Connection

This site communicates over plain, unencrypted HTTP.

The final page URL is unencrypted (http://www.readanybook.com/).

Why it matters: Any information sent or received can be intercepted, read, or modified by anyone on the local network or internet path.

Fix: Avoid submitting credentials, personal details, or payment info on this site.

goodSecurity· Static HTML
+9 pts → 26

No Credential Fields Detected

No password input fields were detected in the page HTML.

No <input type="password"> tags found in static HTML.

Why it matters: The page does not appear to solicit user account passwords.

Fix: None required.

warningSecurity· Static HTML
-12 pts → 14

Automatic Meta-Refresh Redirect

The page initiates an automatic redirect via an HTML meta tag.

Detected <meta http-equiv="refresh" content="360">.

Why it matters: Meta-refresh tags are frequently used in phishing landing pages to rapidly bounce users to credential harvest pages.

Fix: Ensure the redirect destination is legitimate and expected.

warningSecurity· HTTP Header
-7 pts → 7

No Content Security Policy

No Content-Security-Policy header was sent by the server.

Content-Security-Policy header absent.

Why it matters: A CSP provides defense-in-depth against code injection and unauthorized framing.

Fix: Deploy a Content-Security-Policy header.

goodReputation & Domain· Domain Inspection
+9 pts → 16

Normal Domain Pattern

The domain uses a standard top-level domain and natural length.

Host 'readanybook.com' exhibits standard naming structure.

Why it matters: Domain structure conforms to typical human-selected naming conventions.

Fix: None required.

goodContent· Static HTML Content
+8 pts → 24

No Scam Keywords Detected

We did not find aggressive pressure tactics or typical prize scam language.

Zero tracked high-pressure scam keyword phrases matched.

Why it matters: The text does not show obvious automated scam indicators.

Fix: None required.

goodSecurity· HTTP Header
+8 pts → 32

Content Security Policy (CSP) Active

The site defines a Content Security Policy restricting resource execution.

Content-Security-Policy: default-src &#039;none&#039;; script-src &#039;nonce-MTqD8XUuv8KddBay2jjV6D&#039; &#039;unsafe-eval&#039; https://challenges.cloudflare.com; script-sr....

Why it matters: CSP helps prevent Cross-Site Scripting (XSS), malicious script injection, and clickjacking.

Fix: Maintain strict CSP directives without 'unsafe-inline' or 'unsafe-eval' where possible.

goodSecurity· HTTP Header
+8 pts → 40

MIME-Type Sniffing Protection

X-Content-Type-Options is set to 'nosniff'.

X-Content-Type-Options: nosniff.

Why it matters: Prevents browsers from MIME-sniffing a response away from the declared content-type, blocking script execution disguised as images or text.

Fix: Properly configured.

goodSecurity· HTTP Header
+8 pts → 48

Clickjacking Protection Configured

The site controls whether it can be embedded inside iframes on other domains.

Framing restricted via X-Frame-Options: SAMEORIGIN.

Why it matters: Prevents clickjacking attacks where a malicious site disguises the page inside an invisible frame.

Fix: Framing defense properly active.

warningPolicies & Terms· Policy Discovery
-14 pts → 34

No Terms or Privacy Policy Found

No links to a Terms of Service or Privacy Policy were detected on this page.

HTML links scan matched zero policy links.

Why it matters: Legitimate businesses and services publish policies explaining user rights, liability, and data practices.

Fix: Look for policies in the site footer or contact the website operator.

Technical appendix

Security response headers

content-security-policy: default-src 'none'; script-src 'nonce-MTqD8XUuv8KddBay2jjV6D' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
permissions-policy: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
server: cloudflare

Redirect chain

  1. 1. https://readanybook.com/
  2. 2. http://www.readanybook.com/
safer alternatives

This site was rated SUS. Let Sus or Bus find well-known, safe websites that do the same job.

terms & privacy check

No links to a Terms of Service or Privacy Policy were detected on this page.

No Terms or Privacy Policy Found

No links to a Terms of Service or Privacy Policy were detected on this page.

Source code
<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="content-security-policy" content="default-src &#39;none&#39;; script-src &#39;nonce-MTqD8XUuv8KddBay2jjV6D&#39; &#39;unsafe-eval&#39; https://challenges.cloudflare.com; script-src-attr &#39;none&#39;; style-src &#39;unsafe-inline&#39;; img-src &#39;self&#39; https://challenges.cloudflare.com; connect-src &#39;self&#39; https://challenges.cloudflare.com; frame-src &#39;self&#39; https://challenges.cloudflare.com blob:; child-src &#39;self&#39; https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri &#39;self&#39;"><style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131;font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"}body{display:flex;flex-direction:column;height:100vh;min-height:100vh}.main-content{margin:8rem auto;padding-left:1.5rem;max-width:60rem}@media (width <= 720px){.main-content{margin-top:4rem}}#challenge-error-text{background-image:url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+");background-repeat:no-repeat;background-size:contain;padding-left:34px}</style><meta http-equiv="refresh" content="360"></head><body><div class="main-wrapper" role="main"><div class="main-content"><noscript><div class="h2"><span id="challenge-error-text">Enable JavaScript and cookies to continue</span></div></noscript></div></div><script nonce="MTqD8XUuv8KddBay2jjV6D">(function(){window._cf_chl_opt = {cFPWv: 'b',cH: 'zih1533oWy.0ChfjRiaJznGi_m1qJGY533p7zQs3Yjw-1792888479-1.2.1.1-ZrVLwRVBDSzaDoiQz5ICjLC_ZrJtpjn9cqqECKTzsOE.3Ts_E4GJTMM7wFuLtbQu',cITimeS: '1792888479',cN: 'MTqD8XUuv8KddBay2jjV6D',cRay: 'a4fd23075debef5f',cTplC:0,cTplO:0,cTplV:5,cType: 'managed',cUPMDTk:"/?__cf_chl_tk=RtDEmDbY9SFbpkN9uxGphVpOowkjGFAq2sQF3nxP.Qc-1792888479-1.0.1.1-qBIsfcKmDHAoFgl9dIRrPxRIOrt2TPY0cSGKxvVGjLA",cvId: '3',cZone: 'www.readanybook.com',fa:"/?__cf_chl_f_tk=RtDEmDbY9SFbpkN9uxGphVpOowkjGFAq2sQF3nxP.Qc-1792888479-1.0.1.1-qBIsfcKmDHAoFgl9dIRrPxRIOrt2TPY0cSGKxvVGjLA",md: 'vTmJJng7crwyoQteo7mmgop0zDbU2dRoTLHFhRyW41s-1792888479-1.2.1.1-kjK.ydJi96ZiP16q7U.mRI.kgjLX4O309thD.P.eLQbmQRqpOJiziAaaCx79NqofJQordUfM9.iGZ_Vkun1FW_e3RYFpAQArgG8uC7LVOvPitG8GleGE8VlGvSL99lIbE3F3z9a2kaVUiXjRNpXJTZjof9SK7YZLcgCjxusTNrem3WgOIKujkpuWjjdVZJOocEl3rblYI4AyJbdA5TkDOo3Wy.y7j8E9s38KCra8LBZu56Sar7PZuRrMILrK6aJvVN4WiUSrA_Ab7EyZJCxxOjURit4od.ya_8FXidI_DBZmfltSfyygaQ640PuNlNWgniJWBN098yylezDDUaFely2nM2aP4200t9UXpZqwFvpSiN2Guoh4xMnBgb50bX3PuBNgc8wTA9Ktlkzmf77F_vyCY8njgtprT4YZ7C6CHCBZaim2uMfhXckwl3Oozo5TErL214a.TI5FpRRcnF_iE9u6I.nYqg0Z2m8_LhU3_fSKAQEO2TVFBMHcoAQZofsrcVL.Y.hPond7fhWgIjrh6QOho6oc3IrbJbJpqIS_I9mgXRP5wVsKJ5n66fG5A46IO.aAxBf2L9K6whtQQWP6nt94DQE7wzI8Ok4lycDFSKMoXYq.vmUrTu33DJHqAyLR9KjTDzsPz0gXva5Dzute4.PCm1b.fJGGa94gjf76kEblOQuCFvF7BUiaoQwh6KCqM2jivph9GlpYblCy2YyODPmZ1we3OXXOnhqKGkMM4f4a6jKB_qrhb3UlIxtMAMr2MgKPmdNnhoDpWvG_UZD2TLPl6MSpW1GMh_DTGdqcv2iAL9OVLB0xB2_pL1dPG2.nRLz.mBV7SuuL_qrQ.z6A4Dk7usPUld8nvIEznL0ZILfB1FUJfKtJowiB1UlCY6a74y71OPt2RjMHtGrb_f2RbhAa_LF1toAo3iQ_sGan2aDbqmZ5KDLNLTXWopmewPoncNPh97xZa7TzRHY9WGU_7En5jJ0fbMOuG7fNIuEh2iQkiqC4Jiq3Rj6v0y7Rek01',mdrd: 'MZHwOKS3aHBvkUtdpf8tQd1lMTcl1Y3Uusc9lRt.v.A-1792888479-1.2.1.1-WVqU.3HkBmLL6BlDgQUM7_HfCpiaEi_RargLrHeqRif0e61FyAxLKOSSsMySEG1BaY.aSNDbdJiAAtLZDJzgI9rGhll53AO6JuTSV_dR93Dd1mlE1GS9w9RGWJu7ID5Y3wddTCqDR9iXJvRRj.bsvOWsv3VXNOIJtXi1hmYmsityWmH050ffyBKdnaS9MSscHlh0zy6psplHf_HQ7htmjFxhoXH7kcq1eeShLCQqwOTbvg7v5vWrDUzY9skQ5XZDC2TQnbu5ElrML3V8OjqlbVWNY0KzHVIRY3J_uLUvFepZdI6NfCa6PUpbfjw4H4xHJ9BUl.jogpV6zjRblz3Z9OI3MhvS8bfWiBXF7PoYP6kxsAPKRFkItNJNgNT._UQnaXAElDLncWl268IpLermKw',};var a = document.createElement('script');a.nonce = 'MTqD8XUuv8KddBay2jjV6D';a.src = '/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a4fd23075debef5f';window._cf_chl_opt.cOgUHash = location.hash === '' && location.href.indexOf('#') !== -1 ? '#' : location.hash;window._cf_chl_opt.cOgUQuery = location.search === '' && location.href.slice(0, location.href.length - window._cf_chl_opt.cOgUHash.length).indexOf('?') !== -1 ? '?' : location.search;if (window.history && window.history.replaceState) {var ogU = location.pathname + window._cf_chl_opt.cOgUQuery + window._cf_chl_opt.cOgUHash;history.replaceState(null, null,"/?__cf_chl_rt_tk=RtDEmDbY9SFbpkN9uxGphVpOowkjGFAq2sQF3nxP.Qc-1792888479-1.0.1.1-qBIsfcKmDHAoFgl9dIRrPxRIOrt2TPY0cSGKxvVGjLA"+ window._cf_chl_opt.cOgUHash);a.onload = function() {history.replaceState(null, null, ogU);}}document.getElementsByTagName('head')[0].appendChild(a);}());</script></body></html>
the breakdown

Unencrypted HTTP Connection

security
This site communicates over plain, unencrypted HTTP.

No Credential Fields Detected

security
No password input fields were detected in the page HTML.

Automatic Meta-Refresh Redirect

security
The page initiates an automatic redirect via an HTML meta tag.

No Content Security Policy

security
No Content-Security-Policy header was sent by the server.

Normal Domain Pattern

reputation
The domain uses a standard top-level domain and natural length.

No Scam Keywords Detected

content
We did not find aggressive pressure tactics or typical prize scam language.

Content Security Policy (CSP) Active

security
The site defines a Content Security Policy restricting resource execution.

MIME-Type Sniffing Protection

security
X-Content-Type-Options is set to 'nosniff'.

Clickjacking Protection Configured

security
The site controls whether it can be embedded inside iframes on other domains.

No Terms or Privacy Policy Found

policy
No links to a Terms of Service or Privacy Policy were detected on this page.