fail
high severity
Cookie security flags
id: cookie_flags
The session cookie session_id can be read by scripts on the page.
Without HttpOnly, any script running on the page can read the session cookie. That turns a single cross-site scripting bug anywhere on the site into a full account takeover, because the attacker can copy the session rather than needing the password.
Recommended Remediation
Set HttpOnly on session_id. In most frameworks this is one configuration setting rather than a code change.
fail
high severity
Email spoofing protection
id: email_spoofing
No DMARC policy is published.
Anyone can send email that appears to come from your domain. Without DMARC, receiving mail servers have no instruction to reject those messages, so invoice fraud and staff impersonation land in inboxes looking legitimate.
Recommended Remediation
Publish a DMARC record at _dmarc.example-business.com starting at p=none so you can see who is sending as you, then tighten to p=quarantine and finally p=reject once the reports look clean.
warn
medium severity
HTTP security headers
id: security_headers
Content-Security-Policy is not set.
A Content-Security-Policy tells the browser which scripts it is allowed to run. Without one, a single injected script anywhere on the page runs with full access to what your visitors see and type.
Recommended Remediation
Add a Content-Security-Policy, starting in report-only mode so you can see what it would block before it breaks anything.
warn
low severity
DNS hygiene
id: dns_hygiene
Both nameservers belong to a single provider.
If that one provider has an outage, your website and email both disappear at the same time and you have no way to redirect them. Zone transfers are correctly refused, and no dangling records were found.
Recommended Remediation
Add a secondary DNS provider. Most registrars support this and it is usually a configuration change rather than a migration.
error
info severity
Certificate history
id: cert_history
Could not check: the certificate transparency log did not respond in time.
This check reads public certificate transparency logs to find subdomains that were issued certificates and may have been forgotten. The log service was unreachable, so nothing can be said either way.
Recommended Remediation
No action needed from you. Re-run the scan later; this check depends on an external public service.
pass
info severity
Exposed files
id: exposed_artefacts
None of the three checked paths are reachable.
Development files left on a live server can expose source code, database passwords and API keys to anyone who requests them directly. None were found here.
Recommended Remediation
No action needed.
pass
info severity
TLS configuration
id: tls_config
TLS 1.3 with a strong cipher; the certificate has 64 days left.
Traffic between your visitors and your site is encrypted with a current protocol, and the outdated versions that attackers target are refused.
Recommended Remediation
No action needed. Confirm certificate auto-renewal is running so this does not lapse.