Short answer: we ran the same four checks our security guide tells you to run on any operator – on ourselves. Two real issues came back: readme.html and license.txt were both publicly reachable, and four standard security headers were missing. Both are fixed as of this audit. Below are the current, real numbers.
Why re-audit after already publishing a guide
Writing a checklist and never running it against your own site is an easy way to end up giving advice you have not followed yourself. So we reran the four checks from our existing guide, plus a direct headers check, against this domain specifically. What follows is what we found – including the part that needed fixing before we could honestly publish it.
What we found
- readme.html – was reachable, now blocked (403). This file discloses the exact platform version to anyone who requests it. No reason for that to be public, and it now returns an error.
- license.txt – was reachable, now blocked (403). Same category of issue as readme.html, same fix.
- error_log – was already blocked (403). No change needed; this was correct from the start.
- Four security headers were missing – now present. Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. None of these are optional extras; they are baseline configuration every properly hardened site should send.
What those headers actually do
- Strict-Transport-Security forces every connection over HTTPS, closing a window an attacker could use to intercept traffic even if a stored link points to the plain http version.
- X-Content-Type-Options stops a browser from guessing a file type in a way that can be abused to run unintended content.
- X-Frame-Options prevents this site from being loaded inside an invisible frame on another page – the mechanism behind clickjacking.
- Referrer-Policy limits how much of your browsing path is passed along when you click a link away from this site.
Current response time
Measured directly, warm requests, several runs:
- Time to first byte: 0.21-0.25 seconds
- Full page load: 0.50-0.52 seconds, consistent across repeated runs at time of testing
We are publishing the honest range from repeated runs, not a single best-case number.
Run these checks yourself, on any casino site
- Add /readme.html and /license.txt to any domain address. Both should return an error, not a page.
- Check response headers with any free header-checking tool – Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options should all be present.
- Verify the exact domain against PAGCOR registered-domains list before depositing anywhere, regardless of what the site claims about itself. Our licensing page explains how to check both public lists.
Frequently asked questions
What does it mean if a casino readme.html file is publicly reachable?
It discloses the exact software version running the site, which tells an attacker precisely which known vulnerabilities to try. On its own it is a minor issue, but it signals the platform has not been hardened.
Why do security headers matter for an online casino?
Headers like Strict-Transport-Security and X-Frame-Options are instructions your browser follows to prevent specific attacks – connection downgrade and clickjacking among them. Their presence is a baseline hardening signal, not proof of anything on its own.
Does a fast-loading casino site mean it is trustworthy?
Not by itself – licensing and identity verification matter more. But consistent, fast response generally indicates properly maintained infrastructure, the same infrastructure that processes your withdrawals.
How do I run these same checks on a different operator?
Add /readme.html and /license.txt to the domain and see what loads – both should error on a properly hardened site. Check headers with a free online tool, and verify the domain against PAGCOR registered-domains list before depositing.
