demo.securityaudit.pro: security report

Email protection

Email: 25 of 30 points lost

• Fix now
  No SPF record: anyone can send email pretending to be you

  Without a clear SPF record, scammers can send email that appears to come from your business, and your real email is more likely to land in spam.

  How to fix: Publish one SPF record that lists your email services and ends with -all or ~all. Your email provider publishes the exact line to use.

• Improve
  DMARC is in monitor-only mode, so fake email still gets delivered

  A monitor-only policy collects reports but doesn't stop anyone impersonating you.

  How to fix: Once your reports show all your real email passes, change p=none to p=quarantine, then p=reject.

• Improve
  Your domain has no mail server record

  Without a mail server record, nobody can email your domain, and it can be easier to fake.

  How to fix: If you use email at this domain, add the MX records your email provider gives you. If you don't, publish a null MX and an SPF of -all.

• Couldn't check
  We couldn't confirm DKIM email signing

  DKIM signatures prove an email really came from your domain and wasn't changed on the way.

  How to fix: Check with your email provider that DKIM signing is turned on, and publish the DNS records it gives you.

• Good
  Your domain has a DMARC policy

  DMARC tells other mail servers what to do with email that fakes your domain. Without it, fake invoices and password-reset scams are easier to pull off.

• Good
  You receive DMARC reports

  Reports show who is sending email as your domain, including services you forgot about and anyone faking it.

Worth doing (optional)

• Worth doing
  No BIMI record (optional)

  BIMI shows your logo next to your email in some inboxes, which helps customers spot the real thing.

  How to fix: Once your DMARC policy is at quarantine or reject, publish a BIMI record that points to your logo as an SVG file.

• Worth doing
  No MTA-STS policy (optional)

  MTA-STS makes other servers use encryption when they deliver email to you.

  How to fix: Ask your email provider or IT person to publish an MTA-STS policy for your domain, starting in testing mode.

• Worth doing
  No TLS-RPT reporting (optional)

  TLS-RPT reports tell you when mail to you couldn't be delivered securely.

  How to fix: Add a TLS-RPT record (at _smtp._tls) with an email address that receives the reports.

Website security

Website: 10 of 30 points lost

• Improve
  Several recommended security headers are missing

  Security headers are small settings that make common web attacks much harder.

  How to fix: Your developer or host can add the missing headers; most take one line each.

  3 headers missing

• Improve
  Your site's admin login page is publicly reachable

  A public login page invites password-guessing attacks.

  How to fix: Add two-factor sign-in, limit login attempts, or restrict the login page to known locations.

  Found at /wp-login.php

• Good
  Your certificate isn't close to expiring

  When a certificate expires, browsers show visitors a full-page warning instead of your site.

  Expires in 89 days · issued by Let's Encrypt

• Good
  Your website's security certificate is valid

  Browsers warn visitors away from sites with a bad certificate, and information sent to the site isn't protected.

• Good
  Your site can't be hidden inside other sites' pages

  Framing lets a fake page show your real page underneath and trick visitors into clicking.

• Good
  Browsers won't guess your files' types (nosniff)

  If a browser guesses wrong about a file, a harmless-looking upload could be run as a program.

• Good
  Browsers are told to always use https (HSTS)

  HSTS stops browsers from ever falling back to an unencrypted connection to your site.

• Good
  Your forms send information securely

  Anything typed into that form can be read by others on the same network.

  2 pages checked

• Good
  Visitors are always sent to the secure version of your site

  If visitors aren't sent to the secure version automatically, some may use an unencrypted connection that others on the same network can read or tamper with.

• Good
  We didn't find known-vulnerable JavaScript libraries

  Old library versions have published weaknesses that attackers can look up.

  2 pages checked

• Good
  Your secure pages don't load insecure content

  Insecure content on a secure page can be read or changed on the way, and browsers may block it.

  2 pages checked

• Good
  Your site doesn't advertise its software versions

  If your site announces exactly which software it runs, scammers' automated tools can quickly spot sites that haven't been updated.

• Good
  Google doesn't list your site as unsafe

  A listing makes browsers show a red warning page instead of your site.

Worth doing (optional)

• Worth doing
  No Content Security Policy

  A Content Security Policy limits the damage if someone manages to inject a script into your pages.

  How to fix: Ask your developer to add a Content-Security-Policy, starting in report-only mode.

• Worth doing
  Your site doesn't limit browser features like camera and location

  Limiting features reduces what an injected script could do.

  How to fix: Add a Permissions-Policy header that turns off features your site doesn't use.

• Worth doing
  Your site doesn't limit what it shares about visitors' previous page

  Without a policy, full page addresses (which can include private details) are passed to other sites.

  How to fix: Add a Referrer-Policy header such as strict-origin-when-cross-origin.

• Worth doing
  No security.txt contact file (optional)

  A security.txt file tells people who find a problem how to reach you.

  How to fix: Publish /.well-known/security.txt with a contact email.

For your information

• Note
  Your homepage doesn't set cookies

  Cookie settings control whether a cookie can be stolen by a script or sent over an insecure connection.

• Note
  We didn't recognise a site builder (normal for custom sites)

  Knowing your platform tells us which settings you control and which your platform handles.

Domain health

Domain: 0 of 30 points lost

• Good
  Your domain limits who can issue its certificates

  A CAA record makes it harder to get a fraudulent certificate for your domain.

• Good
  Your registration contact details are private

  Public contact details are harvested for spam, phishing and fake renewal notices.

• Good
  Your DNS is signed (DNSSEC)

  DNSSEC stops attackers from forging the answers that send visitors and email to your servers.

• Good
  Your domain registration isn't close to expiring

  If your domain expires, your website and email stop working, and someone else can register it.

  Registration renews or expires in 364 days

• Good
  Your domain is locked against unauthorised transfers

  A transfer lock stops someone moving your domain to another registrar without your approval.

For your information

• Note
  Where your domain is registered and hosted

  This tells us who manages your domain's settings.

  Registered with Cloudflare, Inc · DNS by Cloudflare

Exposure

Exposure: 0 of 30 points lost

For your information

• Note
  Domains that look like yours are registered

  Lookalike domains are sometimes used for fake emails and websites. Many belong to unrelated businesses.

  5 look-alike domains found out of 106 checked

• Note
  The lookalike domains we found

  Most of these are harmless; the ones with email set up deserve a closer look.

  securityaudit.info, securityaudit.io, securityaudit.net, securityaudit.org, securityaudit.us

Website performance

• Good
  Your server responds quickly

  Every extra second of waiting loses visitors.

  First response in 64 ms

For your information

• Note
  Your homepage gives caching instructions

  Caching lets returning visitors load pages faster.

• Note
  Your homepage is compressed

  Compression makes pages download several times faster.

• Note
  Not enough real-visitor data yet

  This is measured from real Chrome users visiting your site.

• Note
  Your site supports HTTP/2

  Newer connection types load many files at once, which speeds up pages.

• Note
  Your site isn't reachable over IPv6

  A growing share of mobile networks prefer IPv6.

• Note
  Your desktop performance score

  Desktop speed matters for customers at work.

  Desktop score 81 (needs improvement)

• Note
  Your mobile performance score

  Slow mobile pages lose visitors and rank lower in Google.

  Mobile score 43 (poor)

Website health notes

Worth doing (optional)

• Worth doing
  We didn't find a privacy policy link

  Customers and payment providers expect a privacy policy when a site collects any information.

  How to fix: Add a privacy policy page and link it from your footer.

• Worth doing
  Your homepage is missing some search basics

  Titles and descriptions are what people see in Google results.

  How to fix: Give each page a clear title, a one-sentence description and one main heading.

  Missing: a page description

For your information

• Note
  We didn't notice common accessibility issues

  Accessibility issues can shut out customers and make your site harder to use for people with disabilities.

  2 pages checked

• Note
  We found no other internal links to test, so links weren't checked

  We test links to other pages on your site. Your pages had none we hadn't already visited.

• Note
  No trackers found, so no cookie notice is needed

  If you have EU or California visitors, you may need a cookie notice.

• Note
  Google Lighthouse scores for your homepage

  These scores come from Google's own site checker.

  Accessibility 100 · Best practices 100 · Search (SEO) 58

• Note
  Your pages don't load scripts from other companies

  Each outside script can slow your site and sees your visitors' activity.