recker 1.0.43 → 1.0.44

package/dist/seo/rules/security.js

@@ -21,7 +21,7 @@ export const securityRules = [
             if (ctx.isHttps === true) {
                 return createResult({ id: 'https-required', name: 'HTTPS', category: 'security', severity: 'error' }, 'pass', 'Page is served over HTTPS');
             }
-            return null;
+            return createResult({ id: 'https-required', name: 'HTTPS', category: 'security', severity: 'error' }, 'info', 'Not applicable (HTTPS status unavailable)', { recommendation: 'This rule checks if the page is served over HTTPS when protocol information is available' });
         },
     },
     {
@@ -42,7 +42,7 @@ export const securityRules = [
                     },
                 });
             }
-            return null;
+            return createResult({ id: 'mixed-content', name: 'Mixed Content', category: 'security', severity: 'error' }, 'info', 'Not applicable (no mixed content detected or HTTPS not used)', { recommendation: 'This rule checks for HTTP resources on HTTPS pages when mixed content is detected' });
         },
     },
     {
@@ -52,8 +52,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'HTTP traffic should redirect to HTTPS',
         check: (ctx) => {
-            if (ctx.httpRedirectsToHttps === undefined)
-                return null;
+            if (ctx.httpRedirectsToHttps === undefined) {
+                return createResult({ id: 'http-redirect', name: 'HTTP to HTTPS Redirect', category: 'security', severity: 'warning' }, 'info', 'Not applicable (HTTP redirect status unavailable)', { recommendation: 'This rule checks if HTTP traffic redirects to HTTPS when redirect information is available' });
+            }
             if (!ctx.httpRedirectsToHttps) {
                 return createResult({ id: 'http-redirect', name: 'HTTP to HTTPS Redirect', category: 'security', severity: 'warning' }, 'warn', 'HTTP does not redirect to HTTPS', {
                     recommendation: 'Configure server to redirect all HTTP traffic to HTTPS',
@@ -67,6 +68,32 @@ export const securityRules = [
             return createResult({ id: 'http-redirect', name: 'HTTP to HTTPS Redirect', category: 'security', severity: 'warning' }, 'pass', 'HTTP redirects to HTTPS');
         },
     },
+    {
+        id: 'internal-links-https',
+        name: 'Internal Links Use HTTPS',
+        category: 'security',
+        severity: 'warning',
+        description: 'Internal links should use HTTPS to avoid mixed content and redirect chains',
+        check: (ctx) => {
+            if (ctx.internalHttpLinks === undefined) {
+                return createResult({ id: 'internal-links-https', name: 'Internal Links Use HTTPS', category: 'security', severity: 'warning' }, 'info', 'Not applicable (internal link data unavailable)', { recommendation: 'This rule checks internal links for HTTPS usage when link analysis is available' });
+            }
+            if (ctx.internalHttpLinks > 0) {
+                const examples = ctx.internalHttpLinkUrls?.slice(0, 3) || [];
+                return createResult({ id: 'internal-links-https', name: 'Internal Links Use HTTPS', category: 'security', severity: 'warning' }, 'warn', `${ctx.internalHttpLinks} internal link(s) use HTTP instead of HTTPS`, {
+                    value: ctx.internalHttpLinks,
+                    recommendation: 'Update all internal links to use HTTPS URLs',
+                    evidence: {
+                        found: `${ctx.internalHttpLinks} HTTP internal links${examples.length > 0 ? `: ${examples.join(', ')}` : ''}`,
+                        expected: 'All internal links should use HTTPS',
+                        impact: 'HTTP links cause unnecessary redirects, slow page loads, and may trigger mixed content warnings. Search engines prefer sites with consistent HTTPS usage.',
+                        learnMore: 'https://web.dev/why-https-matters/',
+                    },
+                });
+            }
+            return createResult({ id: 'internal-links-https', name: 'Internal Links Use HTTPS', category: 'security', severity: 'warning' }, 'pass', 'All internal links use HTTPS');
+        },
+    },
     {
         id: 'security-csp-exists',
         name: 'Content Security Policy (CSP)',
@@ -74,8 +101,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'Content Security Policy header should be present to mitigate XSS attacks.',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-csp-exists', name: 'Content Security Policy', category: 'security', severity: 'warning' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for CSP headers when HTTP response headers are available' });
+            }
             const cspHeader = ctx.responseHeaders['content-security-policy'] || ctx.responseHeaders['Content-Security-Policy'];
             if (!cspHeader) {
                 return createResult({ id: 'security-csp-exists', name: 'Content Security Policy', category: 'security', severity: 'warning' }, 'warn', 'Content-Security-Policy header is missing', {
@@ -97,11 +125,13 @@ export const securityRules = [
         severity: 'warning',
         description: 'CSP should be effective against XSS attacks',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-csp-xss-effective', name: 'CSP XSS Effectiveness', category: 'security', severity: 'warning' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks CSP effectiveness when HTTP response headers are available' });
+            }
             const cspHeader = ctx.responseHeaders['content-security-policy'] || ctx.responseHeaders['Content-Security-Policy'];
-            if (!cspHeader)
-                return null;
+            if (!cspHeader) {
+                return createResult({ id: 'security-csp-xss-effective', name: 'CSP XSS Effectiveness', category: 'security', severity: 'warning' }, 'info', 'Not applicable (CSP header not present)', { recommendation: 'This rule checks CSP effectiveness when a Content-Security-Policy header exists' });
+            }
             const csp = String(cspHeader).toLowerCase();
             const weaknesses = [];
             if (csp.includes("'unsafe-inline'") && !csp.includes("'strict-dynamic'") && !csp.includes("'nonce-")) {
@@ -137,11 +167,13 @@ export const securityRules = [
         severity: 'error',
         description: 'CSP should have script-src and object-src directives to prevent unsafe script execution',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-csp-directives', name: 'CSP Required Directives', category: 'security', severity: 'error' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks CSP directives when HTTP response headers are available' });
+            }
             const cspHeader = ctx.responseHeaders['content-security-policy'] || ctx.responseHeaders['Content-Security-Policy'];
-            if (!cspHeader)
-                return null;
+            if (!cspHeader) {
+                return createResult({ id: 'security-csp-directives', name: 'CSP Required Directives', category: 'security', severity: 'error' }, 'info', 'Not applicable (CSP header not present)', { recommendation: 'This rule checks CSP directives when a Content-Security-Policy header exists' });
+            }
             const csp = String(cspHeader).toLowerCase();
             const missingDirectives = [];
             if (!csp.includes('script-src') && !csp.includes('default-src')) {
@@ -196,8 +228,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'HSTS header forces secure connections and improves SEO indirectly.',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-hsts-exists', name: 'HSTS Header', category: 'security', severity: 'warning' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for HSTS headers when HTTP response headers are available' });
+            }
             const hstsHeader = ctx.responseHeaders['strict-transport-security'] || ctx.responseHeaders['Strict-Transport-Security'];
             if (!hstsHeader) {
                 return createResult({ id: 'security-hsts-exists', name: 'HSTS Header', category: 'security', severity: 'warning' }, 'warn', 'Strict-Transport-Security header is missing', {
@@ -219,11 +252,13 @@ export const securityRules = [
         severity: 'info',
         description: 'HSTS should have a strong policy with long max-age and includeSubDomains',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-hsts-strong', name: 'Strong HSTS Policy', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks HSTS policy strength when HTTP response headers are available' });
+            }
             const hstsHeader = ctx.responseHeaders['strict-transport-security'] || ctx.responseHeaders['Strict-Transport-Security'];
-            if (!hstsHeader)
-                return null;
+            if (!hstsHeader) {
+                return createResult({ id: 'security-hsts-strong', name: 'Strong HSTS Policy', category: 'security', severity: 'info' }, 'info', 'Not applicable (HSTS header not present)', { recommendation: 'This rule checks HSTS policy strength when a Strict-Transport-Security header exists' });
+            }
             const hsts = String(hstsHeader).toLowerCase();
             const weaknesses = [];
             const maxAgeMatch = hsts.match(/max-age\s*=\s*(\d+)/);
@@ -258,8 +293,9 @@ export const securityRules = [
         severity: 'info',
         description: 'COOP ensures proper origin isolation for security',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-coop', name: 'Cross-Origin-Opener-Policy', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for COOP headers when HTTP response headers are available' });
+            }
             const coopHeader = ctx.responseHeaders['cross-origin-opener-policy'] || ctx.responseHeaders['Cross-Origin-Opener-Policy'];
             if (!coopHeader) {
                 return createResult({ id: 'security-coop', name: 'Cross-Origin-Opener-Policy', category: 'security', severity: 'info' }, 'info', 'Cross-Origin-Opener-Policy header is missing', {
@@ -289,8 +325,9 @@ export const securityRules = [
         severity: 'info',
         description: 'COEP prevents loading cross-origin resources without explicit permission',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-coep', name: 'Cross-Origin-Embedder-Policy', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for COEP headers when HTTP response headers are available' });
+            }
             const coepHeader = ctx.responseHeaders['cross-origin-embedder-policy'] || ctx.responseHeaders['Cross-Origin-Embedder-Policy'];
             if (!coepHeader) {
                 return createResult({ id: 'security-coep', name: 'Cross-Origin-Embedder-Policy', category: 'security', severity: 'info' }, 'info', 'Cross-Origin-Embedder-Policy header is missing', {
@@ -312,11 +349,13 @@ export const securityRules = [
         severity: 'info',
         description: 'Trusted Types help prevent DOM-based XSS attacks',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-trusted-types', name: 'Trusted Types', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for Trusted Types in CSP when HTTP response headers are available' });
+            }
             const cspHeader = ctx.responseHeaders['content-security-policy'] || ctx.responseHeaders['Content-Security-Policy'];
-            if (!cspHeader)
-                return null;
+            if (!cspHeader) {
+                return createResult({ id: 'security-trusted-types', name: 'Trusted Types', category: 'security', severity: 'info' }, 'info', 'Not applicable (CSP header not present)', { recommendation: 'This rule checks for Trusted Types when a Content-Security-Policy header exists' });
+            }
             const csp = String(cspHeader).toLowerCase();
             if (csp.includes('require-trusted-types-for')) {
                 return createResult({ id: 'security-trusted-types', name: 'Trusted Types', category: 'security', severity: 'info' }, 'pass', 'Trusted Types policy enabled via CSP');
@@ -338,8 +377,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'X-Frame-Options header should be present to prevent clickjacking.',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-xfo-exists', name: 'X-Frame-Options', category: 'security', severity: 'warning' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for X-Frame-Options headers when HTTP response headers are available' });
+            }
             const xfoHeader = ctx.responseHeaders['x-frame-options'] || ctx.responseHeaders['X-Frame-Options'];
             if (!xfoHeader) {
                 return createResult({ id: 'security-xfo-exists', name: 'X-Frame-Options', category: 'security', severity: 'warning' }, 'warn', 'X-Frame-Options header is missing', {
@@ -361,12 +401,14 @@ export const securityRules = [
         severity: 'info',
         description: 'CSP frame-ancestors is the modern replacement for X-Frame-Options',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-frame-ancestors', name: 'CSP frame-ancestors', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for CSP frame-ancestors when HTTP response headers are available' });
+            }
             const cspHeader = ctx.responseHeaders['content-security-policy'] || ctx.responseHeaders['Content-Security-Policy'];
             const xfoHeader = ctx.responseHeaders['x-frame-options'] || ctx.responseHeaders['X-Frame-Options'];
-            if (!cspHeader && !xfoHeader)
-                return null;
+            if (!cspHeader && !xfoHeader) {
+                return createResult({ id: 'security-frame-ancestors', name: 'CSP frame-ancestors', category: 'security', severity: 'info' }, 'info', 'Not applicable (neither CSP nor X-Frame-Options present)', { recommendation: 'This rule checks CSP frame-ancestors when clickjacking protection headers are present' });
+            }
             if (cspHeader && String(cspHeader).toLowerCase().includes('frame-ancestors')) {
                 return createResult({ id: 'security-frame-ancestors', name: 'CSP frame-ancestors', category: 'security', severity: 'info' }, 'pass', 'CSP frame-ancestors directive present (modern clickjacking protection)');
             }
@@ -380,7 +422,7 @@ export const securityRules = [
                     },
                 });
             }
-            return null;
+            return createResult({ id: 'security-frame-ancestors', name: 'CSP frame-ancestors', category: 'security', severity: 'info' }, 'info', 'Not applicable (clickjacking protection configured without frame-ancestors)', { recommendation: 'This rule checks modern frame-ancestors directive in CSP for enhanced clickjacking protection' });
         },
     },
     {
@@ -390,8 +432,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'Review Access-Control-Allow-Origin header for proper CORS configuration.',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-cors-config', name: 'CORS Configuration', category: 'security', severity: 'warning' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks CORS configuration when HTTP response headers are available' });
+            }
             const acaoHeader = ctx.responseHeaders['access-control-allow-origin'] || ctx.responseHeaders['Access-Control-Allow-Origin'];
             if (acaoHeader === '*') {
                 return createResult({ id: 'security-cors-config', name: 'CORS Configuration', category: 'security', severity: 'warning' }, 'warn', 'Access-Control-Allow-Origin is set to "*"', {
@@ -416,8 +459,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'X-Content-Type-Options header prevents MIME sniffing attacks.',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-xcto-exists', name: 'X-Content-Type-Options', category: 'security', severity: 'warning' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for X-Content-Type-Options headers when HTTP response headers are available' });
+            }
             const xctoHeader = ctx.responseHeaders['x-content-type-options'] || ctx.responseHeaders['X-Content-Type-Options'];
             if (!xctoHeader) {
                 return createResult({ id: 'security-xcto-exists', name: 'X-Content-Type-Options', category: 'security', severity: 'warning' }, 'warn', 'X-Content-Type-Options header is missing', {
@@ -438,8 +482,9 @@ export const securityRules = [
         severity: 'info',
         description: 'Referrer-Policy controls how much referrer information is sent with requests.',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-rp-exists', name: 'Referrer-Policy', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for Referrer-Policy headers when HTTP response headers are available' });
+            }
             const rpHeader = ctx.responseHeaders['referrer-policy'] || ctx.responseHeaders['Referrer-Policy'];
             if (!rpHeader) {
                 return createResult({ id: 'security-rp-exists', name: 'Referrer-Policy', category: 'security', severity: 'info' }, 'info', 'Referrer-Policy header is missing', {
@@ -460,8 +505,9 @@ export const securityRules = [
         severity: 'info',
         description: 'Permissions-Policy controls browser features available to the page.',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-pp-exists', name: 'Permissions-Policy', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for Permissions-Policy headers when HTTP response headers are available' });
+            }
             const ppHeader = ctx.responseHeaders['permissions-policy'] || ctx.responseHeaders['Permissions-Policy'];
             if (!ppHeader) {
                 return createResult({ id: 'security-pp-exists', name: 'Permissions-Policy', category: 'security', severity: 'info' }, 'info', 'Permissions-Policy header is missing', {
@@ -482,8 +528,9 @@ export const securityRules = [
         severity: 'info',
         description: 'X-XSS-Protection is deprecated but may still provide protection in older browsers',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-xxss', name: 'X-XSS-Protection', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for deprecated X-XSS-Protection headers when HTTP response headers are available' });
+            }
             const xxssHeader = ctx.responseHeaders['x-xss-protection'] || ctx.responseHeaders['X-XSS-Protection'];
             if (xxssHeader && String(xxssHeader).includes('1')) {
                 return createResult({ id: 'security-xxss', name: 'X-XSS-Protection', category: 'security', severity: 'info' }, 'info', 'X-XSS-Protection is enabled but deprecated', {
@@ -496,7 +543,7 @@ export const securityRules = [
                     },
                 });
             }
-            return null;
+            return createResult({ id: 'security-xxss', name: 'X-XSS-Protection', category: 'security', severity: 'info' }, 'info', 'Not applicable (X-XSS-Protection not present or disabled)', { recommendation: 'This rule checks for deprecated X-XSS-Protection headers when present' });
         },
     },
     {
@@ -506,8 +553,9 @@ export const securityRules = [
         severity: 'info',
         description: 'CORP restricts which origins can load your resources',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-corp', name: 'Cross-Origin-Resource-Policy', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for CORP headers when HTTP response headers are available' });
+            }
             const corpHeader = ctx.responseHeaders['cross-origin-resource-policy'] || ctx.responseHeaders['Cross-Origin-Resource-Policy'];
             if (!corpHeader) {
                 return createResult({ id: 'security-corp', name: 'Cross-Origin-Resource-Policy', category: 'security', severity: 'info' }, 'info', 'Cross-Origin-Resource-Policy header is missing', {
@@ -529,8 +577,9 @@ export const securityRules = [
         severity: 'error',
         description: 'SSL certificate must be valid and not expired',
         check: (ctx) => {
-            if (ctx.sslCertificate === undefined)
-                return null;
+            if (ctx.sslCertificate === undefined) {
+                return createResult({ id: 'security-ssl-valid', name: 'SSL Certificate Valid', category: 'security', severity: 'error' }, 'info', 'Not applicable (SSL certificate information unavailable)', { recommendation: 'This rule checks SSL certificate validity when certificate information is available' });
+            }
             if (!ctx.sslCertificate.valid) {
                 return createResult({ id: 'security-ssl-valid', name: 'SSL Certificate Valid', category: 'security', severity: 'error' }, 'fail', 'SSL certificate is invalid', {
                     recommendation: 'Renew or replace the SSL certificate immediately',
@@ -550,8 +599,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'SSL certificate should not expire within 30 days',
         check: (ctx) => {
-            if (!ctx.sslCertificate?.expiryDate)
-                return null;
+            if (!ctx.sslCertificate?.expiryDate) {
+                return createResult({ id: 'security-ssl-expiry', name: 'SSL Certificate Expiry', category: 'security', severity: 'warning' }, 'info', 'Not applicable (SSL certificate expiry date unavailable)', { recommendation: 'This rule checks SSL certificate expiration when certificate expiry information is available' });
+            }
             const expiryDate = new Date(ctx.sslCertificate.expiryDate);
             const now = new Date();
             const daysUntilExpiry = Math.floor((expiryDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
@@ -591,8 +641,9 @@ export const securityRules = [
         severity: 'error',
         description: 'SSL certificate CN/SAN must match the domain',
         check: (ctx) => {
-            if (ctx.sslCertificate?.nameMismatch === undefined)
-                return null;
+            if (ctx.sslCertificate?.nameMismatch === undefined) {
+                return createResult({ id: 'security-ssl-name-match', name: 'SSL Certificate Name Match', category: 'security', severity: 'error' }, 'info', 'Not applicable (SSL certificate name match information unavailable)', { recommendation: 'This rule checks SSL certificate name matching when certificate domain information is available' });
+            }
             if (ctx.sslCertificate.nameMismatch) {
                 return createResult({ id: 'security-ssl-name-match', name: 'SSL Certificate Name Match', category: 'security', severity: 'error' }, 'fail', 'SSL certificate name mismatch', {
                     recommendation: 'Get a certificate that matches your domain name',
@@ -613,8 +664,9 @@ export const securityRules = [
         severity: 'error',
         description: 'Server should use TLS 1.2 or higher',
         check: (ctx) => {
-            if (!ctx.tlsVersion)
-                return null;
+            if (!ctx.tlsVersion) {
+                return createResult({ id: 'security-tls-version', name: 'TLS Version', category: 'security', severity: 'error' }, 'info', 'Not applicable (TLS version information unavailable)', { recommendation: 'This rule checks TLS version when TLS connection information is available' });
+            }
             const version = ctx.tlsVersion;
             const insecureVersions = ['SSLv2', 'SSLv3', 'TLSv1', 'TLSv1.0', 'TLSv1.1'];
             if (insecureVersions.includes(version)) {
@@ -637,8 +689,9 @@ export const securityRules = [
         severity: 'info',
         description: 'SSL certificate should be from a trusted CA',
         check: (ctx) => {
-            if (!ctx.sslCertificate?.issuer)
-                return null;
+            if (!ctx.sslCertificate?.issuer) {
+                return createResult({ id: 'security-ssl-issuer', name: 'SSL Certificate Issuer', category: 'security', severity: 'info' }, 'info', 'Not applicable (SSL certificate issuer information unavailable)', { recommendation: 'This rule checks SSL certificate issuer when certificate issuer information is available' });
+            }
             const issuer = ctx.sslCertificate.issuer;
             const selfSigned = issuer.toLowerCase().includes('self-signed') ||
                 ctx.sslCertificate.selfSigned === true;
@@ -661,8 +714,9 @@ export const securityRules = [
         severity: 'error',
         description: 'Password fields must only appear on HTTPS pages',
         check: (ctx) => {
-            if (ctx.hasPasswordField === undefined)
-                return null;
+            if (ctx.hasPasswordField === undefined) {
+                return createResult({ id: 'security-password-on-http', name: 'Password Fields on HTTP', category: 'security', severity: 'error' }, 'info', 'Not applicable (password field information unavailable)', { recommendation: 'This rule checks for password fields on insecure pages when password field data is available' });
+            }
             if (ctx.hasPasswordField && ctx.isHttps === false) {
                 return createResult({ id: 'security-password-on-http', name: 'Password Fields on HTTP', category: 'security', severity: 'error' }, 'fail', 'Password field on insecure HTTP page', {
                     recommendation: 'Enable HTTPS for all pages with password fields',
@@ -674,7 +728,7 @@ export const securityRules = [
             if (ctx.hasPasswordField && ctx.isHttps === true) {
                 return createResult({ id: 'security-password-on-http', name: 'Password Fields on HTTP', category: 'security', severity: 'error' }, 'pass', 'Password fields are on HTTPS');
             }
-            return null;
+            return createResult({ id: 'security-password-on-http', name: 'Password Fields on HTTP', category: 'security', severity: 'error' }, 'info', 'Not applicable (no password fields detected)', { recommendation: 'This rule checks if password fields are only used on HTTPS pages when password fields are present' });
         },
     },
     {
@@ -684,8 +738,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'Forms should only submit to HTTPS endpoints',
         check: (ctx) => {
-            if (ctx.formsOnHttp === undefined)
-                return null;
+            if (ctx.formsOnHttp === undefined) {
+                return createResult({ id: 'security-forms-on-http', name: 'Forms on HTTP', category: 'security', severity: 'warning' }, 'info', 'Not applicable (form submission data unavailable)', { recommendation: 'This rule checks if forms submit to HTTPS endpoints when form data is available' });
+            }
             if (ctx.formsOnHttp > 0) {
                 return createResult({ id: 'security-forms-on-http', name: 'Forms on HTTP', category: 'security', severity: 'warning' }, 'warn', `${ctx.formsOnHttp} form(s) submit to HTTP`, {
                     value: ctx.formsOnHttp,
@@ -705,11 +760,13 @@ export const securityRules = [
         severity: 'info',
         description: 'Server header should not reveal detailed version information',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-server-disclosure', name: 'Server Version Disclosure', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for server version disclosure when HTTP response headers are available' });
+            }
             const serverHeader = ctx.responseHeaders['server'] || ctx.responseHeaders['Server'];
-            if (!serverHeader)
-                return null;
+            if (!serverHeader) {
+                return createResult({ id: 'security-server-disclosure', name: 'Server Version Disclosure', category: 'security', severity: 'info' }, 'info', 'Not applicable (Server header not present)', { recommendation: 'This rule checks for server version disclosure when Server header is present' });
+            }
             const server = String(serverHeader);
             if (/\d+\.\d+/.test(server)) {
                 return createResult({ id: 'security-server-disclosure', name: 'Server Version Disclosure', category: 'security', severity: 'info' }, 'info', `Server header reveals version: ${server}`, {
@@ -720,7 +777,7 @@ export const securityRules = [
                     },
                 });
             }
-            return null;
+            return createResult({ id: 'security-server-disclosure', name: 'Server Version Disclosure', category: 'security', severity: 'info' }, 'info', 'Not applicable (Server header not present or does not disclose version)', { recommendation: 'This rule checks if the Server header reveals version information' });
         },
     },
     {
@@ -730,8 +787,9 @@ export const securityRules = [
         severity: 'info',
         description: 'X-Powered-By header reveals technology stack',
         check: (ctx) => {
-            if (!ctx.responseHeaders)
-                return null;
+            if (!ctx.responseHeaders) {
+                return createResult({ id: 'security-x-powered-by', name: 'X-Powered-By Header', category: 'security', severity: 'info' }, 'info', 'Not applicable (response headers unavailable)', { recommendation: 'This rule checks for X-Powered-By header disclosure when HTTP response headers are available' });
+            }
             const xPoweredBy = ctx.responseHeaders['x-powered-by'] || ctx.responseHeaders['X-Powered-By'];
             if (xPoweredBy) {
                 return createResult({ id: 'security-x-powered-by', name: 'X-Powered-By Header', category: 'security', severity: 'info' }, 'info', `X-Powered-By header present: ${xPoweredBy}`, {
@@ -742,7 +800,7 @@ export const securityRules = [
                     },
                 });
             }
-            return null;
+            return createResult({ id: 'security-x-powered-by', name: 'X-Powered-By Header', category: 'security', severity: 'info' }, 'info', 'Not applicable (X-Powered-By header not present)', { recommendation: 'This rule checks for X-Powered-By header disclosure when the header is present' });
         },
     },
     {
@@ -752,8 +810,9 @@ export const securityRules = [
         severity: 'info',
         description: 'Server should support Server Name Indication (SNI)',
         check: (ctx) => {
-            if (ctx.sniSupported === undefined)
-                return null;
+            if (ctx.sniSupported === undefined) {
+                return createResult({ id: 'ssl-sni-support', name: 'SNI Support', category: 'security', severity: 'info' }, 'info', 'Not applicable (SNI support information unavailable)', { recommendation: 'This rule checks for SNI support when SNI information is available' });
+            }
             if (!ctx.sniSupported) {
                 return createResult({ id: 'ssl-sni-support', name: 'SNI Support', category: 'security', severity: 'info' }, 'info', 'Server may not support SNI', {
                     recommendation: 'Ensure web server supports SNI for proper HTTPS functionality',
@@ -762,7 +821,7 @@ export const securityRules = [
                     }
                 });
             }
-            return null;
+            return createResult({ id: 'ssl-sni-support', name: 'SNI Support', category: 'security', severity: 'info' }, 'info', 'Not applicable (SNI is supported)', { recommendation: 'This rule checks for SNI support issues when SNI is not supported' });
         },
     },
     {
@@ -772,8 +831,9 @@ export const securityRules = [
         severity: 'warning',
         description: 'Sitemap should only contain HTTPS URLs',
         check: (ctx) => {
-            if (ctx.sitemapHttpUrls === undefined)
-                return null;
+            if (ctx.sitemapHttpUrls === undefined) {
+                return createResult({ id: 'sitemap-https-urls', name: 'HTTPS URLs in Sitemap', category: 'security', severity: 'warning' }, 'info', 'Not applicable (sitemap URL data unavailable)', { recommendation: 'This rule checks sitemap URLs for HTTPS usage when sitemap data is available' });
+            }
             if (ctx.sitemapHttpUrls > 0) {
                 return createResult({ id: 'sitemap-https-urls', name: 'HTTPS URLs in Sitemap', category: 'security', severity: 'warning' }, 'warn', `Sitemap contains ${ctx.sitemapHttpUrls} HTTP URLs`, {
                     value: ctx.sitemapHttpUrls,
@@ -795,10 +855,12 @@ export const securityRules = [
         severity: 'info',
         description: 'HTTPS sites should implement HSTS for security',
         check: (ctx) => {
-            if (!ctx.isHttps)
-                return null;
-            if (ctx.hasHsts === undefined)
-                return null;
+            if (!ctx.isHttps) {
+                return createResult({ id: 'security-hsts', name: 'HSTS Header', category: 'security', severity: 'info' }, 'info', 'Not applicable (page is not served over HTTPS)', { recommendation: 'This rule checks HSTS implementation on HTTPS sites only' });
+            }
+            if (ctx.hasHsts === undefined) {
+                return createResult({ id: 'security-hsts', name: 'HSTS Header', category: 'security', severity: 'info' }, 'info', 'Not applicable (HSTS status unavailable)', { recommendation: 'This rule checks for HSTS headers when HSTS information is available' });
+            }
             if (!ctx.hasHsts) {
                 return createResult({ id: 'security-hsts', name: 'HSTS Header', category: 'security', severity: 'info' }, 'info', 'Missing Strict-Transport-Security header', {
                     recommendation: 'Implement HSTS to enforce HTTPS connections',