The fix, in one snippet
This is a deliberate hardening choice, not a fault.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scan page contains two beacons: a normal script that reports to a probe endpoint, and a <noscript> block whose image request fires only when scripts do not run. When only the noscript beacon arrives, JavaScript is disabled globally, blocked for scan.now by a site setting, or blocked by an extension such as NoScript or uBlock Origin's per-site script switch. Server-side checks (headers, user agent, connection address) still run; every browser check that needs JavaScript is marked "not tested" rather than passed. This is informational.
Why it matters
Disabling JavaScript removes most fingerprinting surface (canvas, WebGL, font measurement, hardware values) and most drive-by exploits, which target the script engine. It does not remove everything: the User-Agent, Accept-Language, IP address and CSS-based measurements still leak, and it breaks the majority of modern sites. There is no vulnerability here; the finding exists so you know why the browser results are incomplete. Tor Browser's Safest level, NoScript users and people who blocked scripts for this site specifically will see it.
How to fix it
If it is deliberate, nothing needs fixing. To get a complete scan, allow scripts for scan.now only: Chrome and Edge: Settings > Privacy and security > Site settings > JavaScript > add scan.now to "Allowed to use JavaScript". Firefox: if you use NoScript, choose Temporarily Trust for scan.now; otherwise check javascript.enabled in about:config. Safari: Settings > Security > Enable JavaScript (Safari has no per-site JavaScript control). Tor Browser: lower the security level for this session. Then rerun the browser scanner. Guides: the browser security checklist, settings that matter and browser fingerprinting explained.
Where this fits
JavaScript disabled is check 15 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Hardware details exposed to scripts (info), where scripts on any page can read your CPU core count, approximate memory, screen geometry, touch capability and in some browsers battery and network state, all of which feed a fingerprint. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
JavaScript disabled closes one route in. The next one down is User-Agent Client Hints exposure, where your browser answers high-entropy Client Hints requests, revealing its exact version, platform version, device model and CPU architecture to any site that asks.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: JavaScript disabled (info severity)
Scanner check id: javascript-disabledThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 05, 2026
Is My Browser Secure? A Practical Checklist
A secure browser is up to date, enforces the web's security policies, leaks little through WebRTC and fingerprinting, and runs only...
Read the guide
7 min read · Updated Sep 08, 2026
Browser Security Settings That Actually Matter (Chrome, Firefox, Safari, Edge)
Most browser settings pages are long, but only a handful change your real exposure. The settings worth changing in each major browser,...
Read the guide
7 min read · Updated Sep 02, 2026
Browser Fingerprinting Explained: How Sites Identify You Without Cookies
Browser fingerprinting combines dozens of small facts about your browser and device into an identifier that survives cookie deletion and...
Read the guide