31 – Privacy (Webbkoll)

The test audits what a web page reveals about its visitors to third parties, using a Webbkoll backend you run yourself.

It replaces test 20, which called the public Webbkoll service. Since summer 2026 Webperf runs its own installation: that makes the test faster, independent of someone else's uptime, and it puts no load on a service run by volunteers.

What is tested?

• HTTPS: that the page is served encrypted and that no content is fetched over insecure HTTP
• TLS version: that an outdated version isn't in use

• Referrer policy: that it protects the visitor

  The test accepts no-referrer, same-origin and strict-origin. The browsers' modern default, strict-origin-when-cross-origin, is deliberately not accepted, because it still leaks which website the visitor came from to other websites. Webbkoll flags that as a warning too.

• HSTS: that the header exists and has a long enough max-age, at least six months

• Cookies: how they're set and how long they live

How it affects the score

The usual five-point scale, from "great on privacy" to "very bad privacy".

Prerequisites

The test requires a webbkoll backend to be running. Webperf Core can start it for you if it's installed, and shuts it down again when the run finishes.

Running the test

python default.py -u https://example.com -t 31 -r

Settings

See also

• 20 – Integrity & Security (Webbkoll)
• 21 – HTTP & Network