Skip to content
Check a domain

Sample report

A report for example.com.In the exact format you'd get.

Written by hand for the reserved address example.com. Not a scan of a real website.

Get one for your site Download PDF

Quick Scan · example.com

example.com
Areas checked
11
In good shape
2
Fixes in minutes
4
Fix first
2
  • HTTPS with a redirect from plain HTTP F7
  • SPF record published F8

Where to start: PHP (F1) and the session cookie (F2), then the DMARC record (F3).

Where a report shows Configuration health, it carries the line "Counts what our checks can see. Not a guarantee."

F1 · technology-fingerprint

Update an outdated component

Medium Likely Hours

What it means
Your homepage announces PHP 7.4. Moving to a supported version brings back regular security updates and closes the issues public vulnerability data lists for 7.4.
Evidence
X-Powered-By: PHP/7.4.3
PHP 7.4 — end of life 2022-11-28
Expected
A supported PHP 8 release (8.3 or later), version not announced (expose_php = Off)
Fix
Ask your host to move the site to a supported PHP version (8.x). Then stop advertising the version at all: set expose_php = Off.
Limits
We read the version your homepage announces. The running version can differ, and a vulnerability-database match is a strong signal to update rather than proof the issue applies to your site.

F2 · cookie-flags

Keep the login cookie on HTTPS

Medium Confirmed Minutes

What it means
The session cookie is set without the Secure flag. Adding it keeps the cookie on encrypted connections, so signed-in sessions stay private, even on public Wi-Fi.
Evidence
Set-Cookie: PHPSESSID=…; path=/
              ↑ no Secure, no HttpOnly
Expected
Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax
Fix
Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.
Limits
We checked the cookie your homepage sets. Cookies set after login are outside a Quick Scan.

F3 · dns-email-auth

Add a DMARC record for your domain

Low Confirmed Minutes

What it means
A DMARC record tells receiving mail servers what to do with email that claims to come from your domain, so they can turn away mail that only pretends to be you.
Evidence
_dmarc.example.com  TXT  (no record)
Expected
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Fix
Publish a _dmarc TXT record. Start with v=DMARC1; p=none; rua=mailto:dmarc@your-domain to monitor, then move to p=quarantine.
Limits
We checked the public DNS record; your mail provider's own settings are outside a Quick Scan.

F4 · security-headers

Tell browsers to always use HTTPS

Low Confirmed Minutes

What it means
An HSTS header sends browsers straight to https://, even when a visitor types your address without it, so after the first visit, every return visit goes straight to an encrypted connection. Adding your site to the HSTS preload list covers the very first visit too.
Evidence
Strict-Transport-Security: (header absent)
Expected
Strict-Transport-Security: max-age=31536000; includeSubDomains
Fix
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain works over HTTPS.
Limits
We looked at the homepage response only.

F5 · security-headers

Add a Content Security Policy

Low Confirmed Days

What it means
A Content Security Policy tells browsers which scripts your pages may load. A restrictive, well-configured CSP can limit what injected script loads or where it sends data.
Evidence
Content-Security-Policy: (header absent)
Fix
Start with Content-Security-Policy-Report-Only to learn what the site legitimately loads, then enforce the policy.
Limits
A CSP is a backstop; testing for the injection flaws it contains sits outside a Quick Scan.

F6 · crawler-files

Publish a way to report a security problem

Low Confirmed Minutes

What it means
A security.txt file gives anyone who spots a problem with your site a clear, safe way to tell you.
Evidence
GET /.well-known/security.txt → 404
Fix
Publish /.well-known/security.txt with a Contact: line and an Expires: date.
Limits
We checked the standard location only.

F7 · https-behaviour

Your site answers over HTTPS and redirects plain HTTP

Informational Confirmed Minutes

What it means
Visitors who arrive over http:// are moved to an encrypted connection.
Evidence
GET http://example.com/ → 301
GET https://example.com/ → 200
Fix
Nothing to do.
Limits
This confirms the redirect works. The full encryption (TLS) test is reported as its own findings.

F8 · dns-email-auth

SPF record found

Informational Confirmed Minutes

What it means
Receiving mail servers can check which servers are allowed to send email for your domain.
Evidence
example.com  TXT  v=spf1 include:_spf.mail.example -all
Fix
Nothing to do. Pair it with DMARC (F3) so the policy is enforced.
Limits
We read the record itself; the servers it includes are outside this check.

Software the site revealed about itself.

Technologies found on the site
TechnologySeen inNote
PHP 7.4.3X-Powered-By headerEnd of life — see F1
nginxServer headerVersion not announced
jQuery 3.6.0Script URL on the homepageNo known issues matched

In the real product

Keep every report.Free, with only the email you ask for.

A free account saves every finding, the evidence and your scan history.

  • Export it

    PDF for the person who fixes it, JSON for your own tracking.

  • Re-check after fixes

    One credit per re-check. Spare credits last 12 months.

  • Sign in your way

    A passkey, Google, Apple or an email link.

Behind the findings

Also useful: What we check Pricing How it works

See what your website shows.Know what to fix first.

See pricing