example.com

Public security posture · Completed

Share on X

Security grade

D
Configuration score52/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
4
Medium
2
Low
3
Informational
14 of 23 assessed checks passed · 1 not assessed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

If an attacker intercepts user traffic, they could manipulate the site's content or steal user data because the site does not redirect to HTTPS and lacks a Content Security Policy. The site is already doing well in several areas, such as having a trusted HTTPS certificate, not disclosing exact versions, and having a secure DNS configuration. To further improve security, the site should focus on implementing missing security headers and configuring its HTTPS setup correctly.

  1. 01Return a 301 redirect from every http:// URL to its https:// equivalent.HTTP to HTTPS redirectmedium
  2. 02Add Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain supports HTTPS.HTTP Strict Transport Securitymedium
  3. 03Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs.Content Security Policymedium
  4. 04Add Content-Security-Policy: frame-ancestors 'none' (or 'self'), and X-Frame-Options: DENY for older browsers.Framing protectionmedium
  5. 05Add X-Content-Type-Options: nosniff to all responses.MIME type sniffinglow

meta/llama-3.3-70b-instruct-fp8-fast · Workers AI

Website & claims

What the site says, checked against data
Screenshot of example.com at scan time
example.com · captured at scan time
Page title
Example Domain
Domain registered
Aug 14, 1995 · 11391 days before this scan
Registrar
RESERVED-Internet Assigned Numbers Authority
Contract address on site
None shown
Links on site
None found

No checkable claims found on the site (supply, tax, liquidity, ownership, audits, partners, team or age).

Claims are quoted verbatim from the page. “Matches” and “Doesn't match” come from on-chain data, the token's metadata or public domain records. Anything we can't check against data is marked “Can't verify”, which is not the same as false.

TLS & transport

2 findings
mediumConfirmed

HSTS header missing

The site does not tell browsers to always use HTTPS.

Strict-Transport-Security
(not set)
Recommendation · Add Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain supports HTTPS.
Why it matters ↓

HSTS tells browsers to never load the site over HTTP again, closing the downgrade window that the redirect alone leaves open.

How we check: Reads the Strict-Transport-Security header on the HTTPS response and checks max-age is at least 180 days.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
mediumConfirmed

HTTP does not redirect to HTTPS

The homepage is served over plain HTTP without redirecting to HTTPS.

Request
GET http://example.com/
Response
200, page served over HTTP
Recommendation · Return a 301 redirect from every http:// URL to its https:// equivalent.
Why it matters ↓

Visitors who type the bare domain arrive over HTTP first. If that page is served instead of redirected, the first hop can be intercepted.

How we check: Requests the homepage over plain HTTP and checks that the first response redirects to HTTPS.

https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://example.com/
Status
200
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

5 findings
mediumConfirmed

No framing protection

Any website can load this page inside an invisible frame and overlay it with misleading content.

X-Frame-Options
(not set)
CSP frame-ancestors
(not set)
Recommendation · Add Content-Security-Policy: frame-ancestors 'none' (or 'self'), and X-Frame-Options: DENY for older browsers.
Why it matters ↓

Without framing protection, another site can embed this one invisibly and trick users into clicking — for example approving a transaction.

How we check: Checks for X-Frame-Options or a CSP frame-ancestors directive.

https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
mediumConfirmed

Content Security Policy missing

The browser is not told which script sources to trust, so any injected script will run.

Content-Security-Policy
(not set)
Recommendation · Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs. Use nonces or hashes instead of 'unsafe-inline'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
lowConfirmed

X-Content-Type-Options missing

Browsers may guess content types, which can turn a harmless-looking file into executable script.

X-Content-Type-Options
(not set)
Recommendation · Add X-Content-Type-Options: nosniff to all responses.
Why it matters ↓

Stops browsers from interpreting uploaded or mislabelled files as scripts or stylesheets.

How we check: Checks that X-Content-Type-Options is set to nosniff.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
infoConfirmed

Referrer-Policy not set

Modern browsers default to a safe policy, but older ones may send full URLs to other sites.

Referrer-Policy
(not set)
Recommendation · Add Referrer-Policy: strict-origin-when-cross-origin.
Why it matters ↓

URLs can contain tokens, wallet addresses or referral codes. A strict policy keeps them from leaking to third parties.

How we check: Reads the Referrer-Policy header and flags policies that leak full URLs to other sites.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

1 finding
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
DNSSEC validatedPassed
The resolver authenticated the answer with DNSSEC.
AD flag
set
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 -all
DMARC enforced (p=reject)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.example.com
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://example.com/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

All checks passed
No known-malicious releases referencedPassed
Checked 1 script and the homepage HTML against published malicious wallet-package releases.
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 1 script and the homepage HTML reference a source map.
No contract addresses referencedPassed
No EVM addresses were found in 1 script and the homepage HTML.

Wallet stack detected

No wallet or chain libraries recognised in the inspected code.

Inspected 1 script (2 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

No EVM addresses found in the inspected code.

Verification status from Sourcify. Green chains link to the block explorer.

Agent trace

21 steps · every action the agent took
Show the full trace ↓
  1. 0.0s▸Public assessment of example.com · budget 60 requests
  2. 0.0s✓Resolved example.com → 172.66.147.243 (+3 more), all public
  3. 0.1s▸Probing HTTPS, HTTP and legacy TLS
  4. 0.1s✓GET https://example.com/ → 200 in 8ms
  5. 0.1s!GET http://example.com/ → 200, no redirect to HTTPS
  6. 0.1s·TLS 1.0 probe not possible from this network
  7. 0.1s·TLS 1.1 probe not possible from this network
  8. 0.1s·Security headers present: none
  9. 0.1s·0 cookies set on the homepage
  10. 0.2s▸Reading DNS, security.txt and the page's JavaScript
  11. 0.2s·Homepage references 1 script; reading s.js
  12. 0.2s·s.js (2 KB)
  13. 0.2s·No wallet or chain libraries recognised
  14. 0.2s·security.txt not found (HTTP 404)
  15. 0.2s·DNS: DNSSEC on · CAA none · SPF set · DMARC reject
  16. 0.3s✓Graded D (52/100) · 0 high, 4 medium, 2 low · 12 requests to the target
  17. 6.9s✓Rendered the homepage in a browser and saved a screenshot: "Example Domain"
  18. 6.9s·Domain registered 1995-08-14 (11391 days ago) via RESERVED-Internet Assigned Numbers Authority
  19. 7.3s◆Writing summary with meta/llama-3.3-70b-instruct-fp8-fast and checking the site's claims
  20. 8.6s◆No checkable claims found on the site
  21. 15.9s◆Summary ready · 5 prioritized fixes

Scope & limitations

Assessment type
Public, non-invasive
Target
example.com
Final URL
https://example.com/
Resolved addresses
172.66.147.243, 104.20.23.154, 2606:4700:10::ac42:93f3, 2606:4700:10::6814:179a
Scanned
Oct 21, 2026, 09:24 UTC
Duration
0.3s
Requests made
12 (budget 60)
Report ID
hun565yu2v
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own example.com? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.