New check
56Caution
SUS

this is sus — proceed with caution

Final verdict: Not Valid

Something here could be dangerous. We suggest skipping it, or check it through an official source.

URLOct 25, 2026 • 14:03
Share this verdict
5
good
4
warning
0
bad

Scan coverage

https://login.artofproblemsolving.com/login • 10/25/2026, 2:03:50 PM • HTTP 200

✓ Static HTML: completed✓ Security Headers: completed✓ Redirect Inspection: completed✓ Tracker Detection: completed⚠ Privacy Policy: not found⚠ Terms of Service: not found○ Browser Behavior: unavailable
Risk vectors & defense depthConfidence: 96% · Zero-trust baseline
Transport & TLS86%
Guarded
Content & Scripts88%
Caution
Telemetry Surface96%
Moderate
Legal Governance86%
Deficient

Key security observations

TransportTLS encryption active, but HSTS is not strictly enforced
Forms & InputPassword input fields present; they submit to the same origin
Telemetry2 third-party trackers or analytics services detected
GovernanceNo privacy policy or terms of service documentation found
GuidanceSomething here could be dangerous. We suggest skipping it, or check it through an official source.

Actions that would improve score

Enable Strict-Transport-Security (max-age >= 31536000; preload)+9 pts
Deploy Content-Security-Policy with strict script-src and frame-ancestors+7 pts
Publish formal Privacy Policy and Terms of Service documents+14 pts

How the score was calculated

Baseline50
Good findings (5)+46
Warnings & issues (4)-40
Final score56/100 · SUS
goodSecurity· HTTP Response
+10 pts → 60

HTTPS Transport Enabled

Traffic between your browser and this server is encrypted over TLS.

The final page URL is served over HTTPS (https://login.artofproblemsolving.com/login).

Why it matters: Encryption prevents network eavesdroppers from intercepting your data or tampering with page content in transit.

Fix: Note that while HTTPS encrypts traffic, it does not verify whether the site's content or business is trustworthy.

warningSecurity· Static HTML
-12 pts → 48

Password Input Field Present

This page contains a password input field.

Found <input type="password"> in page HTML.

Why it matters: Legitimate login pages ask for passwords, but cloned phishing sites do too. Verify you are on the authentic domain.

Fix: Confirm the domain in your browser's address bar matches the exact service you intend to log into.

warningSecurity· HTTP Header
-7 pts → 41

No Content Security Policy

No Content-Security-Policy header was sent by the server.

Content-Security-Policy header absent.

Why it matters: A CSP provides defense-in-depth against code injection and unauthorized framing.

Fix: Deploy a Content-Security-Policy header.

goodReputation & Domain· Domain Inspection
+9 pts → 50

Normal Domain Pattern

The domain uses a standard top-level domain and natural length.

Host 'login.artofproblemsolving.com' exhibits standard naming structure.

Why it matters: Domain structure conforms to typical human-selected naming conventions.

Fix: None required.

goodContent· Static HTML Content
+9 pts → 59

No Scam Keywords Detected

We did not find aggressive pressure tactics or typical prize scam language.

Zero tracked high-pressure scam keyword phrases matched.

Why it matters: The text does not show obvious automated scam indicators.

Fix: None required.

warningSecurity· HTTP Header
-7 pts → 52

Missing HSTS Header

The server does not send a Strict-Transport-Security header.

No Strict-Transport-Security header found in HTTP response.

Why it matters: Without HSTS, initial visits could be vulnerable to SSL-stripping on hostile networks (e.g. public Wi-Fi).

Fix: Enable HSTS on the origin web server.

goodSecurity· HTTP Header
+9 pts → 61

Content Security Policy (CSP) Active

The site defines a Content Security Policy restricting resource execution.

Content-Security-Policy: frame-ancestors &#039;self&#039;.

Why it matters: CSP helps prevent Cross-Site Scripting (XSS), malicious script injection, and clickjacking.

Fix: Maintain strict CSP directives without 'unsafe-inline' or 'unsafe-eval' where possible.

goodSecurity· HTTP Header
+9 pts → 70

Clickjacking Protection Configured

The site controls whether it can be embedded inside iframes on other domains.

Framing restricted via X-Frame-Options: SAMEORIGIN.

Why it matters: Prevents clickjacking attacks where a malicious site disguises the page inside an invisible frame.

Fix: Framing defense properly active.

warningPolicies & Terms· Policy Discovery
-14 pts → 56

No Terms or Privacy Policy Found

No links to a Terms of Service or Privacy Policy were detected on this page.

HTML links scan matched zero policy links.

Why it matters: Legitimate businesses and services publish policies explaining user rights, liability, and data practices.

Fix: Look for policies in the site footer or contact the website operator.

Technical appendix

Security response headers

content-security-policy: frame-ancestors 'self'
x-frame-options: SAMEORIGIN
server: cloudflare

Redirect chain

  1. 1. https://login.artofproblemsolving.com/
  2. 2. https://login.artofproblemsolving.com/login
safer alternatives

This site was rated SUS. Let Sus or Bus find well-known, safe websites that do the same job.

terms & privacy check

No links to a Terms of Service or Privacy Policy were detected on this page.

No Terms or Privacy Policy Found

No links to a Terms of Service or Privacy Policy were detected on this page.

Source code
<!doctype html>

<html lang="en">

<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width,initial-scale=1.0">
  <title>Sign In | AoPS</title>
  <link rel="icon" type="image/png" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-favicon.d51890de7fdb8282894e.ico">
  <!-- For iPhone 6 Plus with @3× display: -->
  <link rel="apple-touch-icon-precomposed" sizes="180x180" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png">
  <!-- For iPad with @2× display running iOS ≥ 7: -->
  <link rel="apple-touch-icon-precomposed" sizes="152x152" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png">
  <!-- For iPad with @2× display running iOS ≤ 6: -->
  <link rel="apple-touch-icon-precomposed" sizes="144x144" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png">
  <!-- For iPhone with @2× display running iOS ≥ 7: -->
  <link rel="apple-touch-icon-precomposed" sizes="120x120" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png">
  <!-- For iPhone with @2× display running iOS ≤ 6: -->
  <link rel="apple-touch-icon-precomposed" sizes="114x114" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png">
  <!-- For the iPad mini and the first- and second-generation iPad (@1× display) on iOS ≥ 7: -->
  <link rel="apple-touch-icon-precomposed" sizes="76x76" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png">
  <!-- For the iPad mini and the first- and second-generation iPad (@1× display) on iOS ≤ 6: -->
  <link rel="apple-touch-icon-precomposed" sizes="72x72" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png">
  <!-- For non-Retina iPhone, iPod Touch, and Android 2.1+ devices: -->
  <link rel="apple-touch-icon-precomposed" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png"><!-- 57×57px -->
  <link rel="apple-touch-icon" href="https://static-pl.artofproblemsolving.com/login/dist/assets/online-apple-touch-icon.5719d301aacd5e843e0a.png">
  <link href="https://static-pl.artofproblemsolving.com/login/dist/main.34a37a6d9a8bfe4467bf.css" rel="stylesheet" >
  <script src="https://static-pl.artofproblemsolving.com/login/dist/main.43988ec663df1b66e00d.js" ></script>
    <script>window.platverifier = "np6zzlK/kVBS0QWn3Zke6rjao5xCJjxiLI0+5fDlgvA"</script>
</head>

<body>
  <script src="https://static-pl.artofproblemsolving.com/login/dist/loginShared.ae8898bf52cb461dae2e.js"  crossorigin="anonymous"></script>
<script>
    window.googleAuthClientId = "974567057575-i6lv6mcrtt6htja297reg0ivui9bos91.apps.googleusercontent.com";
</script>
<!-- Google Identity Services library -->
<script src="https://accounts.google.com/gsi/client" async defer></script>
<script src="https://static-pl.artofproblemsolving.com/login/dist/googleAuth.9e59015f44001af1fbcb.js"  crossorigin="anonymous"></script>

<div id="container" class="main">
  <div class="container-background">
		<img class="main-logo" src="https://static-pl.artofproblemsolving.com/login/dist/assets/aops-logo.8fb4cc8f081845b60563.svg" />
    <div class="container-outer">
      <div class="container-content">
        	<div class="error-box"></div>	<div class="hide-on-alternate">
        		<div class="main-inputs">
        			<div class="pl-input">
        				<input type="text" name="loginId" id="login-id" autocomplete="username" autocapitalize="none" autocomplete="on" autocorrect="off" spellcheck="false" placeholder=" ">
        				<label for="login-id">Email or Username</label>
        				<div class="input-error">
        					<img src="https://static-pl.artofproblemsolving.com/login/dist/assets/error-icon.f2e907cf983bba0fbc01.svg"><span></span>
        				</div>
        			</div>
        			<div class="pl-input">
        				<input type="password" name="password" id="password" autocomplete="current-password" placeholder=" ">
        				<label for="password">Password</label>
        				<img id="show-password-icon" class="eye-icon" src="https://static-pl.artofproblemsolving.com/login/dist/assets/eye.bba4b7a03a052197a678.svg">
        				<img id="hide-password-icon" class="eye-icon" src="https://static-pl.artofproblemsolving.com/login/dist/assets/eye-slash.3b7b9c5cb82cdf2419c9.svg">
        				<div class="input-error">
        					<img src="https://static-pl.artofproblemsolving.com/login/dist/assets/error-icon.f2e907cf983bba0fbc01.svg"><span></span>
        				</div>
        			</div>
        		</div>
        
        		<button id="login-button" type="button">
        				Sign In
        		</button>
        
        		<div class="divider">
        			<span>or</span>
        		</div>
        
        		<button id="google-signin-button" type="button" class="google-signin-button">
        			<svg class="google-icon" width="18" height="18" viewBox="0 0 24 24">
        				<path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/>
        				<path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/>
        				<path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/>
        				<path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/>
        			</svg>
        				<span class="button-text">Sign in with Google</span>
        			</button>
        
        		<div class="bottom-content">
        					<div class="text">Forgot your password? <a id="forgot-switch">Reset password</a></div>
        
        		</div>
        	</div>
        
        	<div id="resend-email-confirmation" data-type="">
        		<h2 class="type-confirm">Verify your email address</h2>
        		<h2 class="type-setup">Finish setting up your account</h2>
        		<p>
        			<span class="type-confirm">We've sent a confirmation to the email associated
        				with your account:
        			</span>
        			<span id="resend-setup-prompt" class="type-setup"></span>
        			<b id="resend-login-id"></b>
        		</p>
        		<p>
        			<span class="type-confirm">Check your email for a link to confirm your
        				email.</span>
        			<span class="type-setup">If you cannot find these instructions in your
        				inbox, you can request a new email below.</span>
        		</p>
        	
        		<button id="resend-button-confirm"></button>
        	</div>	<div id="must-reset-password">
        		<h2>Reset your password</h2>
        		<p>Please reset the password on your account.</p>
        		<p>
        			The reset link will be sent to: <span id="must-reset-login-id"></span>
        		</p>
        		<p>
        			If you recently requested a reset, please check your email for a link to reset your password.
        		</p>
        	
        		<button id="resend-button-reset">Send Link</button>
        		<div class="text">
        			<a id="go-to-login">Back to Sign In</a>
        		</div>
        	</div>
      </div>
    </div>
    <div class="other-logos">
					<a href="https://artofproblemsolving.com?utm_source=platform_login&utm_medium=online_logo&utm_campaign=platform_links" target="_blank">
						<img src="https://static-pl.artofproblemsolving.com/login/dist/assets/online-logo.4fad2e8b2a5815fdadf7.svg">
					</a>
					<a href="https://beastacademy.com?utm_source=platform_login&utm_medium=ba_logo&utm_campaign=platform_links" target="_blank">
						<img src="https://static-pl.artofproblemsolving.com/login/dist/assets/ba-logo.3cc525b43a66855af873.svg">
					</a>
					<a href="https://aopsacademy.org?utm_source=platform_login&utm_medium=academy_logo&utm_campaign=platform_links" target="_blank">
						<img src="https://static-pl.artofproblemsolving.com/login/dist/assets/academy-logo.09ac3a17f422fa5d692e.svg">
					</a>
    </div>
  </div>
</div>

</body>
the breakdown

HTTPS Transport Enabled

security
Traffic between your browser and this server is encrypted over TLS.

Password Input Field Present

security
This page contains a password input field.

No Content Security Policy

security
No Content-Security-Policy header was sent by the server.

Normal Domain Pattern

reputation
The domain uses a standard top-level domain and natural length.

No Scam Keywords Detected

content
We did not find aggressive pressure tactics or typical prize scam language.

Missing HSTS Header

security
The server does not send a Strict-Transport-Security header.

Content Security Policy (CSP) Active

security
The site defines a Content Security Policy restricting resource execution.

Clickjacking Protection Configured

security
The site controls whether it can be embedded inside iframes on other domains.

No Terms or Privacy Policy Found

policy
No links to a Terms of Service or Privacy Policy were detected on this page.