The sample report, explained

Our sample report for a demo website, one part at a time, with a note on what each part tells you.

example.com is a demonstration domain: we made up what it shows, then ran it through our real checks and report.

This is the score, out of 100. It only counts the checks we could complete, and it always says how many that was. Below it, each area's score, or why there's none.

Security Configuration Score

84 out of 100

Based on the externally observable configuration checks performed, example.com scored 84/100.

33 of 34 checks completed.

HTTPS & redirects 5 of 5 checks 80
TLS & certificates 6 of 6 checks 100
Email domain 6 of 7 checks, partial 69
Security headers 7 of 7 checks 75
DNS 7 of 7 checks 100
Cookies Doesn't apply
Public configuration 2 of 2 checks 100

These are the problems worth your attention, most important first. Each one says what we saw, why it matters and who can fix it.

Important findings

Medium
www.example.com does not redirect HTTP to HTTPS

Visitors who type the address without https:// stay on an unencrypted connection, where their traffic can be read or changed.

Who fixes it: Your web host or website developer
Medium
example.com has no DMARC record

Without DMARC, receivers have no domain-published instructions for handling mail that fails authentication, and the owner gets no reports of abuse.

Who fixes it: Your email provider
Low
https://example.com/ has no Content-Security-Policy

Without a Content-Security-Policy, the browser has no extra limits on what scripts or resources the page can load if an injection flaw is ever found.

Who fixes it: Your web host or website developer
Low
https://example.com/ has no Strict-Transport-Security header

Without HSTS, browsers only know to use HTTPS after visiting once, leaving the first visit (and any plain-HTTP link) open to interception.

Who fixes it: Your web host or website developer

This is your to-do list, sorted by who does the work. Pass each part to the right person: your web host or developer, your email provider, and so on.

What to fix, and who fixes it

Your web host or website developer (3)

Medium www.example.com does not redirect HTTP to HTTPS

Redirect every plain-HTTP request to the same address over HTTPS.

Configuration examples

nginx

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Apache

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Cloudflare

SSL/TLS → Edge Certificates → Always Use HTTPS: On.

Low https://example.com/ has no Content-Security-Policy

Start with a Content-Security-Policy in report-only mode, check the reports, then enforce it. Report-only violations only appear in the browser's developer console unless a report-to or report-uri endpoint is added to receive them. A good policy needs tailoring to the site; the example is a starting point, not a drop-in.
Configuration examples

nginx
```
add_header Content-Security-Policy-Report-Only "default-src 'self'" always;
```
Apache
```
Header always set Content-Security-Policy-Report-Only "default-src 'self'"
```
Low https://example.com/ has no Strict-Transport-Security header

Add the Strict-Transport-Security header with a max-age of at least six months (a year is common). Add includeSubDomains or preload only once every subdomain serves HTTPS.
Configuration examples

nginx
```
add_header Strict-Transport-Security "max-age=31536000" always;
```
Apache
```
Header always set Strict-Transport-Security "max-age=31536000"
```
Cloudflare
```
SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS): enable, with a max-age of 12 months.
```

Your email provider (1)

The records themselves are added at your DNS provider.

Medium example.com has no DMARC record

Publish a DMARC record, starting at p=none while reports are reviewed.
Configuration examples

DNS record
```
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:<reports address>"
```

Everything that passed, so you can see what's already in good shape.

Passed checks

HTTPS & redirects: HTTPS availability, No HTTPS to HTTP downgrade, Redirect behaviour, Mixed content
TLS & certificates: Certificate validity, Certificate name, Certificate trust, Outdated TLS versions, Modern TLS versions, TLS 1.3
Email domain: SPF record, SPF default policy, SPF validity
Security headers: X-Content-Type-Options, Clickjacking protection, Referrer-Policy, X-XSS-Protection
DNS: Stale DNS alias, Nameserver redundancy, www host, Public addresses, Domain registration expiry
Public configuration: Directory listing, Software version disclosure

Every check, with its result. A Note never lowers your score, and Not checked never counts as a pass.

Detailed results

HTTPS & redirects 80/100, 5 of 5 checks completed

4 passed · 1 issue

Passed HTTPS availability: example.com serves HTTPS
Medium HTTP to HTTPS redirect: www.example.com does not redirect HTTP to HTTPS
Passed No HTTPS to HTTP downgrade: example.com never redirects from HTTPS to HTTP
Passed Redirect behaviour: example.com redirects cleanly
Passed Mixed content: https://example.com/ loads everything over HTTPS

TLS & certificates 100/100, 6 of 6 checks completed

6 passed

Passed Certificate validity: The certificate for example.com is valid for 196 more days
Passed Certificate name: The certificate for example.com matches the name
Passed Certificate trust: The certificate on example.com is trusted
Passed Outdated TLS versions: example.com does not accept TLS 1.0 or 1.1
Passed Modern TLS versions: example.com supports TLS 1.2 or 1.3
Passed TLS 1.3: example.com offers TLS 1.3

Email domain 69/100, 6 of 7 checks completed

3 passed · 1 issue · 2 notes · 1 not checked · 3 don't apply

Passed SPF record: example.com has an SPF record
Passed SPF default policy: example.com's SPF record ends in a restrictive all
Passed SPF validity: example.com's SPF record is valid
Medium DMARC record: example.com has no DMARC record
Doesn't apply DMARC policy: No DMARC record was found.
Doesn't apply DMARC coverage: No DMARC record was found.
Doesn't apply DMARC reporting: No DMARC record was found.
Note MTA-STS: example.com does not publish MTA-STS
Note TLS reporting: example.com does not publish TLS-RPT
Not checked DKIM: DKIM can't generally be checked from the domain alone, because each signing key is published under a name (a selector) that only the sender knows. The analyser does not guess selectors.

Security headers 75/100, 7 of 7 checks completed

4 passed · 2 issues · 1 note

Low Strict-Transport-Security: https://example.com/ has no Strict-Transport-Security header
Low Content-Security-Policy: https://example.com/ has no Content-Security-Policy
Passed X-Content-Type-Options: https://example.com/ sets X-Content-Type-Options
Passed Clickjacking protection: https://example.com/ is protected against clickjacking
Passed Referrer-Policy: https://example.com/ sets Referrer-Policy
Note Permissions-Policy: https://example.com/ has no Permissions-Policy header
Passed X-XSS-Protection: https://example.com/ does not enable the legacy X-XSS-Protection filter

DNS 100/100, 7 of 7 checks completed

5 passed · 2 notes

Passed Stale DNS alias: example.com has no dangling CNAME
Passed Nameserver redundancy: example.com has redundant nameservers
Note DNSSEC: DNSSEC is not enabled for example.com
Note CAA records: example.com has no CAA records
Passed www host: www.example.com resolves
Passed Public addresses: example.com resolves only to public addresses
Passed Domain registration expiry: example.com's registration is not expiring soon

Cookies Doesn't apply

3 don't apply

Doesn't apply Cookie Secure flag: The home page did not set any cookies.
Doesn't apply Cookie HttpOnly flag: The home page did not set any cookies.
Doesn't apply Cookie SameSite attribute: The home page did not set any cookies.

Public configuration 100/100, 2 of 2 checks completed

2 passed

Passed Directory listing: https://example.com/ is not a directory listing
Passed Software version disclosure: https://example.com/ does not reveal a software version

Exactly what we looked at, and how much. Nothing else on the site was checked.

About this analysis

Only example.com and www.example.com were contacted, on ports 80 and 443, with ordinary GET requests.
DNS and email records were read for example.com, and the domain's registry was asked once for its registration date.
Not examined: other subdomains, other ports, other pages or paths, and third-party services. Addresses found in the page were never requested.

HTTP requests: 6, TLS handshakes: 12, DNS queries: 26, Registry lookups: 1.

DNSSEC is judged from the presence of DS records at the parent zone and DNSKEY records at the domain. Signatures are not validated, and the DS record is not matched against the keys.

This is a passive, point-in-time analysis of the domain's external security configuration, limited to the checks listed in this report. It is not a penetration test, a vulnerability assessment or a security certification, and it is not proof that the website is secure.