New check
79Safe
BUS

this is bussin — looks legit

Final verdict: Valid

This one gives no reason to worry. You can go ahead, but never share passwords you did not mean to.

URLOct 25, 2026 • 02:15
Share this verdict
8
good
2
warning
0
bad

Scan coverage

https://cloudconvert.com/ • 10/25/2026, 2:15:26 AM • HTTP 200

✓ Static HTML: completed✓ Security Headers: completed✓ Redirect Inspection: completed✓ Tracker Detection: completed⚠ Privacy Policy: not found⚠ Terms of Service: not found○ Browser Behavior: unavailable
Risk vectors & defense depthConfidence: 96% · Zero-trust baseline
Transport & TLS93%
Guarded
Content & Scripts100%
Clean
Telemetry Surface100%
Minimal
Legal Governance86%
Deficient

Key security observations

TransportTLS encryption strictly enforced with long-duration HSTS
Forms & InputNo credential or password input fields detected on page
TelemetryZero third-party trackers or advertising beacons detected
GovernanceNo privacy policy or terms of service documentation found
GuidanceThis one gives no reason to worry. You can go ahead, but never share passwords you did not mean to.

Actions that would improve score

Deploy Content-Security-Policy with strict script-src and frame-ancestors+7 pts
Publish formal Privacy Policy and Terms of Service documents+14 pts

How the score was calculated

Baseline50
Good findings (8)+50
Warnings & issues (2)-21
Final score79/100 · BUS
goodSecurity· HTTP Response
+7 pts → 57

HTTPS Transport Enabled

Traffic between your browser and this server is encrypted over TLS.

The final page URL is served over HTTPS (https://cloudconvert.com/).

Why it matters: Encryption prevents network eavesdroppers from intercepting your data or tampering with page content in transit.

Fix: Note that while HTTPS encrypts traffic, it does not verify whether the site's content or business is trustworthy.

goodSecurity· Static HTML
+7 pts → 64

No Credential Fields Detected

No password input fields were detected in the page HTML.

No <input type="password"> tags found in static HTML.

Why it matters: The page does not appear to solicit user account passwords.

Fix: None required.

warningSecurity· HTTP Header
-7 pts → 57

No Content Security Policy

No Content-Security-Policy header was sent by the server.

Content-Security-Policy header absent.

Why it matters: A CSP provides defense-in-depth against code injection and unauthorized framing.

Fix: Deploy a Content-Security-Policy header.

goodReputation & Domain· Domain Inspection
+6 pts → 63

Normal Domain Pattern

The domain uses a standard top-level domain and natural length.

Host 'cloudconvert.com' exhibits standard naming structure.

Why it matters: Domain structure conforms to typical human-selected naming conventions.

Fix: None required.

goodContent· Static HTML Content
+6 pts → 69

No Scam Keywords Detected

We did not find aggressive pressure tactics or typical prize scam language.

Zero tracked high-pressure scam keyword phrases matched.

Why it matters: The text does not show obvious automated scam indicators.

Fix: None required.

goodSecurity· HTTP Header
+6 pts → 75

Strict Transport Security (HSTS)

The site instructs browsers to only connect over HTTPS in the future.

Strict-Transport-Security: max-age=31536000; includeSubDomains.

Why it matters: HSTS protects users against SSL-stripping and man-in-the-middle downgrade attacks.

Fix: Maintain HSTS configuration with includeSubDomains and preload.

goodSecurity· HTTP Header
+6 pts → 81

Content Security Policy (CSP) Active

The site defines a Content Security Policy restricting resource execution.

Content-Security-Policy: frame-ancestors &#039;self&#039;; script-src &#039;self&#039; https://static.cloudconvert.com &#039;nonce-hamB2B5KiExyHqaw&#039; https://js.stripe.com....

Why it matters: CSP helps prevent Cross-Site Scripting (XSS), malicious script injection, and clickjacking.

Fix: Maintain strict CSP directives without 'unsafe-inline' or 'unsafe-eval' where possible.

goodSecurity· HTTP Header
+6 pts → 87

MIME-Type Sniffing Protection

X-Content-Type-Options is set to 'nosniff'.

X-Content-Type-Options: nosniff.

Why it matters: Prevents browsers from MIME-sniffing a response away from the declared content-type, blocking script execution disguised as images or text.

Fix: Properly configured.

goodSecurity· HTTP Header
+6 pts → 93

Clickjacking Protection Configured

The site controls whether it can be embedded inside iframes on other domains.

Framing restricted via X-Frame-Options: SAMEORIGIN.

Why it matters: Prevents clickjacking attacks where a malicious site disguises the page inside an invisible frame.

Fix: Framing defense properly active.

warningPolicies & Terms· Policy Discovery
-14 pts → 79

No Terms or Privacy Policy Found

No links to a Terms of Service or Privacy Policy were detected on this page.

HTML links scan matched zero policy links.

Why it matters: Legitimate businesses and services publish policies explaining user rights, liability, and data practices.

Fix: Look for policies in the site footer or contact the website operator.

Technical appendix

Security response headers

content-security-policy: frame-ancestors 'self'; script-src 'self' https://static.cloudconvert.com 'nonce-hamB2B5KiExyHqaw' https://js.stripe.com 'sha256-tYCcUbFfjZ9QESuTWESGWrFg2SmiEdyD2MYUfRWUgK0='; report-to default; form-action 'self'
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(),microphone=()
server: cloudflare
terms & privacy check

No links to a Terms of Service or Privacy Policy were detected on this page.

No Terms or Privacy Policy Found

No links to a Terms of Service or Privacy Policy were detected on this page.

Source code
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    
    <link rel="icon" type="image/png" sizes="144x144" href="https://static.cloudconvert.com/build/assets/favicon-144-Cew_0rgK.png">
    <link rel="icon" type="image/svg+xml" href="https://static.cloudconvert.com/build/assets/logo-QM8X4IMd.js">
    <link rel="apple-touch-icon" sizes="180x180" href="https://static.cloudconvert.com/build/assets/apple-touch-icon-gaCvqugM.png">
    <meta name="apple-itunes-app" content="app-id=842077384">
    <link rel="preconnect" href="https://api.cloudconvert.com">

        <link rel="preload" as="style" href="https://static.cloudconvert.com/build/assets/app-BNARpJPb.css" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/app-xWTo769n.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/dist-CzrQjWDQ.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/runtime-core.esm-bundler-DVRkMeDb.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/preload-helper-BBX2UaU0.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/Presence-Dp6tleYR.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/rolldown-runtime-XKyaHtl9.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/dist-BgzK2W6m.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/dist-tlfLTUkG.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/tv-DJLlSGc0.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/VisuallyHidden-Xp0GGM1m.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/UIcon-KZ1UtfcP.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/base-Dpbq8onI.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/Kbd-C2v6JmkZ.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/useLocale-CZ5yZ8fW.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/Link-BTdVPTzb.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/ComboboxVirtualizer-D4PXof73.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/getActiveElement-DWEoD8ZB.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/usePortal-xcDxT17k.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/useForwardExpose-Cqj9pWhD.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/FocusScope-NPPlZ40m.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/useComposing-B23ZfVjm.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/usePrimitiveElement-CTGMcVkV.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/useTypeahead-60DKnfhm.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/Collection-Bmnd_LBd.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/PopperArrow-c7gg2Rag.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/useKbd-D5ogEQRo.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/VisuallyHiddenInput-cMUSK6au.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/RovingFocusGroup-BmOArDun.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/useArrowNavigation-LczgkNfS.js" nonce="hamB2B5KiExyHqaw" /><link rel="modulepreload" as="script" href="https://static.cloudconvert.com/build/assets/utils-DTWskMUQ.js" nonce="hamB2B5KiExyHqaw" /><link rel="stylesheet" href="https://static.cloudconvert.com/build/assets/app-BNARpJPb.css" nonce="hamB2B5KiExyHqaw" /><script type="module" src="https://static.cloudconvert.com/build/assets/app-xWTo769n.js" nonce="hamB2B5KiExyHqaw"></script>    </head>
<body>  

<script data-page="app" type="application/json">{"component":"Converter","props":{"errors":{},"csp_nonce":"hamB2B5KiExyHqaw","env":"production","base_url":"https:\/\/cloudconvert.com","api_url":"https:\/\/api.cloudconvert.com","sandbox_url":"https:\/\/sandbox.cloudconvert.com","live_url":"https:\/\/cloudconvert.com","socketio_url":"https:\/\/socketio.cloudconvert.com","ai_enabled":true,"query":[],"auth":{"impersonating":false,"user":null},"meta":{"title":null,"description":"File converter service - more than 200 different audio, video, document, ebook, archive, image, spreadsheet and presentation formats supported."},"title":"Convert Any File","text":"Drop a file and pick what to turn it into. CloudConvert handles 200+ formats across documents, images, audio, video, archives and more \u2014 straight from your browser.","outputStorages":[]},"url":"\/","version":"","sharedProps":["errors","csp_nonce","env","base_url","api_url","sandbox_url","live_url","socketio_url","ai_enabled","query","auth"],"onceProps":{"csp_nonce":{"prop":"csp_nonce","expiresAt":null},"env":{"prop":"env","expiresAt":null},"base_url":{"prop":"base_url","expiresAt":null},"api_url":{"prop":"api_url","expiresAt":null},"sandbox_url":{"prop":"sandbox_url","expiresAt":null},"live_url":{"prop":"live_url","expiresAt":null},"socketio_url":{"prop":"socketio_url","expiresAt":null},"ai_enabled":{"prop":"ai_enabled","expiresAt":null}}}</script><div id="app"></div>
</body>
</html>
the breakdown

HTTPS Transport Enabled

security
Traffic between your browser and this server is encrypted over TLS.

No Credential Fields Detected

security
No password input fields were detected in the page HTML.

No Content Security Policy

security
No Content-Security-Policy header was sent by the server.

Normal Domain Pattern

reputation
The domain uses a standard top-level domain and natural length.

No Scam Keywords Detected

content
We did not find aggressive pressure tactics or typical prize scam language.

Strict Transport Security (HSTS)

security
The site instructs browsers to only connect over HTTPS in the future.

Content Security Policy (CSP) Active

security
The site defines a Content Security Policy restricting resource execution.

MIME-Type Sniffing Protection

security
X-Content-Type-Options is set to 'nosniff'.

Clickjacking Protection Configured

security
The site controls whether it can be embedded inside iframes on other domains.

No Terms or Privacy Policy Found

policy
No links to a Terms of Service or Privacy Policy were detected on this page.