Example report

example-bakery.com

Taken 19 Sept 2026, 09:14 UTCReading EX4MPL37Duration 192sAreas evaluated 5/5

This is an example report built from invented data, published so you can see the output before entering your own domain. It is not a reading of any real website.

3 high-severity findings, 16 in total.

Everything below is something this scan observed from outside, worst first. Start with the list of what to do, use the filters to narrow it, and open a finding for the technical detail.

3High
6Medium
5Low
2Informational
4Passed

Observed posture index

of 100

Needs improvement

Areas evaluated: 5/5

How this is calculated

What to do first

The findings that warrant action, in order. Everything else is below.

No DMARC record was foundHighAsk them to publish a DMARC record at p=none with a reporting address first, read the reports for a month, then move to quarantine and finally reject.
A weak cipher suite is offeredHighAsk them to adopt the Mozilla intermediate cipher list and remove everything outside it.
An outdated TLS version is still enabledHighAsk them to accept TLS 1.2 and TLS 1.3 only, and to remove TLS 1.0 and 1.1.

Where the findings are

DNS hygiene92 of 100

Good2 findings

Email domain security63 of 100

Needs improvement3 findings

HTTPS and TLS38 of 100

Weak3 findings

Public web configuration83 of 100

Needs improvement3 findings

Security headers54 of 100

Weak5 findings

Non-destructive public assessment

Severity

Area

Showing 16 of 16 findings

High

No DMARC record was found

Email domain securityHigh

Technical

No TXT record beginning with v=DMARC1 was published at _dmarc under the domain.

Observed: _dmarc TXT; absent
Standard: RFC 7489

ConfirmedReview of the mail domain's public records

What this means

Your domain does not tell receiving mail servers what to do with messages that fail your checks, and does not ask anyone to report it. You have no visibility into who is sending mail as you.

Even with SPF in place, receiving servers are not told to act on a failure. Gmail and Yahoo now require DMARC for bulk senders, so this also affects deliverability.

What to ask your developer

Ask them to publish a DMARC record at p=none with a reporting address first, read the reports for a month, then move to quarantine and finally reject.

How to fix it

dns

TXT at _dmarc: "v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain". Move to p=quarantine then p=reject once reports are clean.

datatracker.ietf.org

A weak cipher suite is offered

HTTPS and TLSHigh

Technical

The server offered a cipher suite in the RC4, 3DES, NULL, EXPORT or anonymous Diffie-Hellman families, or a suite without authenticated encryption.

Observed: cipher; TLS_RSA_WITH_3DES_EDE_CBC_SHA

ConfirmedReview of the encrypted connection and the certificate

What this means

Among the encryption options your server offers, at least one is considered broken or too weak to rely on. A connection that ends up using it is not meaningfully protected.

An attacker who can influence suite selection can push the connection onto the weak option and attack the traffic from there.

What to ask your developer

Ask them to adopt the Mozilla intermediate cipher list and remove everything outside it.

How to fix it

nginxssl_prefer_server_ciphers off; ssl_ciphers <mozilla-intermediate-list>;

apacheUse the Mozilla intermediate SSLCipherSuite list.

caddyThe default suite list is already modern and rarely needs tuning.

ssl-config.mozilla.org

An outdated TLS version is still enabled

HTTPS and TLSHigh

Technical

The server negotiated TLS 1.0 or TLS 1.1. Both were deprecated by RFC 8996 in 2021 and are disabled by default in current browsers.

Observed: protocol; TLS 1.0, TLS 1.1
Standard: RFC 8996

ConfirmedReview of the encrypted connection and the certificate

What this means

Your server still accepts an old version of the encryption protocol. Modern browsers no longer use it, but an attacker can try to force a connection down to it, where known weaknesses apply.

Leaving the old version enabled keeps downgrade attacks viable and fails most payment and compliance checklists, including PCI DSS.

What to ask your developer

Ask them to accept TLS 1.2 and TLS 1.3 only, and to remove TLS 1.0 and 1.1.

How to fix it

nginxssl_protocols TLSv1.2 TLSv1.3;

apacheSSLProtocol -all +TLSv1.2 +TLSv1.3

caddytls { protocols tls1.2 tls1.3 }

cloudflareSet Minimum TLS Version to 1.2 under SSL/TLS, Edge Certificates.

Medium

The SPF record ends in a permissive rule

Email domain securityMedium

Technical

The SPF record terminates in +all or ?all rather than ~all or -all.

Observed: SPF; ends in ?all
Standard: RFC 7208

ConfirmedReview of the mail domain's public records

What this means

You have an SPF record, which is good, but it ends by telling receiving servers to accept mail from anywhere anyway. The record exists but is not enforcing anything.

Forged mail from your domain still passes SPF, so the record gives false reassurance in audits.

What to ask your developer

Ask them to change the ending to -all once every legitimate sending service is listed.

How to fix it

dnsReplace the trailing +all or ?all with -all after verifying every sender is included.

datatracker.ietf.org

The certificate expires soon

HTTPS and TLSMedium

Technical

The notAfter field of the leaf certificate is within 21 days of the scan date.

Observed: notAfter; 2026-10-06; 17 days

ConfirmedReview of the encrypted connection and the certificate

What this means

The certificate that proves your site is really yours runs out in less than 21 days. When it does, every visitor sees a full-page browser warning and most will leave.

An expired certificate is an outage in practice. Browsers block the page, and API clients and payment integrations fail at the same moment.

What to ask your developer

Ask them to confirm automatic renewal is actually running, not just scheduled. Renewals fail silently more often than they fail loudly.

How to fix it

genericForce one renewal now and confirm the served certificate date changed, then fix the timer.

caddyCheck the logs for certificate obtain errors if the served date is not moving.

cloudflareUniversal SSL renews automatically. A custom uploaded certificate does not and must be replaced manually.

letsencrypt.org

A cookie is readable by JavaScript

Security headersMedium

Technical

A Set-Cookie response header was observed without the HttpOnly attribute.

Observed: Set-Cookie; HttpOnly absent; 1

ConfirmedReview of the headers received from the site

What this means

At least one cookie can be read by any script running on the page. If a hostile script ever gets in, through a plugin or a third-party widget, it can take that cookie.

It turns a script injection into a full session takeover rather than a contained incident.

What to ask your developer

Ask them to add HttpOnly to every cookie that does not need to be read by front-end code.

How to fix it

genericSet-Cookie: name=value; Secure; HttpOnly; SameSite=Lax; Path=/

owasp.org

Content-Security-Policy header is missing

Security headersMedium

Technical

No Content-Security-Policy header was present in the response.

Observed: Content-Security-Policy; absent

ConfirmedReview of the headers received from the site

What this means

Your pages do not tell the browser which sources of code and content are legitimate. If anything hostile gets onto a page, whether through a plugin, an ad or a comment, the browser will run it without question.

A policy is the main defence that limits the damage of an injected script. It does not prevent the injection; it limits what the injected code can reach.

What to ask your developer

Ask them to start with Content-Security-Policy-Report-Only, watch the reports for a week, then enforce the policy once it is clean.

How to fix it

generic

Start with: default-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'. Add sources as the reports show real needs.

nginxadd_header Content-Security-Policy "default-src 'self'" always;

cloudflareA Transform Rule can add the header, but the policy itself must come from whoever knows the page dependencies.

Strict-Transport-Security header is missing

Security headersMedium

Technical

The HTTPS response did not include a Strict-Transport-Security header.

Observed: Strict-Transport-Security; absent

ConfirmedReview of the headers received from the site

What this means

Your site uses HTTPS, but it never tells browsers to insist on it. The first visit of the day can still be pushed onto the unencrypted version before the redirect happens.

An attacker on the same network can strip the redirect and serve a plain-HTTP copy of the site. The header removes that window after the first successful visit.

What to ask your developer

Ask them to add Strict-Transport-Security with a max-age of at least one year. Start short, confirm nothing breaks, then raise it.

How to fix it

nginxadd_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

apacheHeader always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

caddyheader Strict-Transport-Security "max-age=31536000; includeSubDomains"

cloudflareEnable HSTS under SSL/TLS, Edge Certificates, and read the warning before enabling preload.

An encrypted page loads unencrypted content

Public web configurationMedium

Technical

The passive scan observed a subresource reference with an http scheme on an https page.

Observed: subresource scheme; http; 2

ConfirmedReview of public responses and pages

What this means

A page served over HTTPS pulls in an image, script or stylesheet over plain HTTP. Browsers either block it, which breaks the page, or warn about it, which worries visitors.

An unencrypted script on an encrypted page can be replaced in transit, which gives an attacker control of the page. An image is less severe but still leaks the visit.

What to ask your developer

Ask them to change the affected references to https, or to protocol-relative form if the resource supports both.

How to fix it

genericUpdate the reference to https. Add Content-Security-Policy: upgrade-insecure-requests as a transitional measure only.

developer.mozilla.org

Low

No CAA record restricts who may issue certificates

DNS hygieneLow

Technical

No CAA resource record was published at the domain apex.

Observed: CAA; absent
Standard: RFC 8659

ConfirmedReview of the domain's public records

What this means

Any certificate authority in the world can currently issue a certificate for your domain. A CAA record narrows that to the ones you actually use. This is hardening, not a weakness in your current setup.

It removes one path to a fraudulently issued certificate. It does not mean a fraudulent certificate exists, and no evidence of one was observed.

What to ask your developer

Ask whoever manages your DNS to add a CAA record naming the certificate authority you use.

How to fix it

dns0 issue "letsencrypt.org" at the apex, plus 0 iodef "mailto:security@your-domain" to be notified of refusals.

datatracker.ietf.org

DNSSEC does not appear to be enabled

DNS hygieneLow

Technical

No DS record was observed at the parent zone and no signed answer was returned for the apex.

Observed: DNSSEC DS record; absent at the parent zone

Medium confidenceReview of the domain's public records

What this means

Your domain's DNS answers are not cryptographically signed, so a resolver cannot prove an answer was not tampered with in transit. Many domains run this way; enabling it closes one class of redirection attack.

DNS answers can be forged by an attacker positioned to do so. Confidence is medium because a registrar or resolver can mask the signal from outside.

What to ask your developer

Ask your registrar whether DNSSEC can be enabled for this domain. With most providers it is a single switch.

How to fix it

dnsEnable DNSSEC at the DNS provider, then confirm the registrar publishes the matching DS record at the parent.

datatracker.ietf.org

Referrer-Policy header is missing

Security headersLow

Technical

No Referrer-Policy header was present, so the browser default applies per navigation type.

Observed: Referrer-Policy; absent

ConfirmedReview of the headers received from the site

What this means

When someone clicks a link off your site, the browser tells the destination where they came from. Current browsers send only your domain, not the full address, because they apply a sensible default when a site does not choose one. Setting the header is how you choose it yourself instead of inheriting whatever each browser decides.

Without the header the behaviour is the browser's to choose, and it has changed before. An older browser, or one configured differently, can send the full address; internal paths, search terms and tokens embedded in URLs would then reach the destination. Setting it makes the behaviour yours rather than a default you are relying on.

What to ask your developer

Ask them to set Referrer-Policy to strict-origin-when-cross-origin, which keeps analytics working.

How to fix it

nginxadd_header Referrer-Policy "strict-origin-when-cross-origin" always;

caddyheader Referrer-Policy "strict-origin-when-cross-origin"

developer.mozilla.org

X-Content-Type-Options header is missing

Security headersLow

Technical

The response did not include X-Content-Type-Options: nosniff.

Observed: X-Content-Type-Options; absent

ConfirmedReview of the headers received from the site

What this means

Browsers are allowed to guess what a file really is instead of trusting what your server said it was. An uploaded image that actually contains code can end up being run as code.

Where a site accepts uploads, MIME sniffing is one of the ways an uploaded file can end up executed as code. The header stops the browser guessing, which closes that route. Whether your site has such a route is not something this check can see.

What to ask your developer

Ask them to send X-Content-Type-Options: nosniff on every response. It is widely deployed and rarely breaks anything, but test it against any endpoint that serves files with a deliberately loose content type.

How to fix it

nginxadd_header X-Content-Type-Options "nosniff" always;

apacheHeader always set X-Content-Type-Options "nosniff"

caddyheader X-Content-Type-Options "nosniff"

developer.mozilla.org

The server announces its exact software version

Public web configurationLow

Technical

The Server or X-Powered-By header contained a specific version string.

Observed: Server; nginx/1.18.0 (Ubuntu)

ConfirmedReview of public responses and pages

What this means

Every response tells visitors which software and which version is running. Nobody needs that to use your site, and it lets an attacker skip the work of finding out.

Version disclosure is reconnaissance, not a vulnerability. It lowers the cost of targeting a known issue; it does not prove one is present.

What to ask your developer

Ask them to suppress the version from the Server header and remove X-Powered-By entirely.

How to fix it

nginxserver_tokens off; and remove any add_header X-Powered-By line.

apacheServerTokens Prod and ServerSignature Off.

caddyCaddy does not send a version in the Server header by default.

owasp.org

Informational

DKIM could not be checked without a selector

Email domain securityInformational

Technical

DKIM public keys are published at selector._domainkey. Without the selector, absence and unknown-selector are indistinguishable, so no conclusion is drawn.

Observed: DKIM selector; not discoverable

Low confidenceReview of the mail domain's public records

What this means

DKIM signing cannot be confirmed from outside without knowing the name your mail provider uses, or seeing a signed message. This is not a finding against your domain; it is a limit of what a public check can see.

None on its own. It means this particular check cannot give you an answer, not that something is wrong.

What to ask your developer

Ask your mail provider which DKIM selector they use, then confirm a signed message validates.

No security.txt file was published

Public web configurationInformational

Technical

No file was served at /.well-known/security.txt.

Observed: /.well-known/security.txt; 404

ConfirmedReview of public responses and pages

What this means

There is no published way for someone who finds a problem with your site to tell you about it. Researchers who cannot find a contact often give up, or post publicly instead.

None directly. It changes what happens after someone finds something, which is when having a contact matters most.

What to ask your developer

Ask them to publish a short security.txt with a contact address and an expiry date.

How to fix it

genericServe /.well-known/security.txt with Contact: and Expires: fields. See RFC 9116 for the full format.

datatracker.ietf.org

Passed

PassedThe site is reachable over HTTPS
PassedHTTP traffic is redirected to HTTPS
PassedEmbedding in another site is blocked
PassedEvery request stayed on HTTPS

Modules

Check	Check type	Duration	Status
DNS records	Review of the domain's public records	1.9sshared	Completed
Email security	Review of the mail domain's configuration	2.1sshared	Completed
Web configuration	Review of public responses and configuration	3.4s	Completed
Passive web assessment	Passive review of public pages and responses	137.9s	Completed
HTTPS and TLS	Review of the encrypted connection and the certificate	46.8s	Completed