The server correctly redirects HTTP traffic to HTTPS.
No action required.
The server returned a successful HTTP response.
No action required.
The page a host serves — its title, generator meta, and the hostname it redirects to — usually names what software runs on it. For an IP address with no domain records, this is often the fastest way to tell what the host actually is.
No action required — this is informational identification, not a finding.
HTTPS can establish a valid certificate for this domain.
No action required.
TLS 1.2 and 1.3 are the modern, secure protocol versions. Older versions (1.0, 1.1, SSLv3) have known vulnerabilities and are disabled here.
No action required.
Strong cipher suites (AES-GCM, ChaCha20-Poly1305) protect against eavesdropping and tampering. Weak ciphers (RC4, DES, 3DES, CBC, NULL, EXPORT) are deprecated and prohibited by PCI DSS Req 4.2.1.
Mozilla — server-side TLS guide · PCI SSC — migrating from early TLS
No action required.
The certificate chain is complete and validates against trusted root CAs.
No action required.
Certificate Transparency (CT) helps detect misissued certificates. Most modern CAs include Signed Certificate Timestamps (SCTs) by default.
No action required.
OCSP (Online Certificate Status Protocol) checks whether a certificate has been revoked by the issuing CA before its expiration date. Some CAs (e.g. Let's Encrypt since 2025) no longer provide OCSP and use CRLs instead.
No action required.
HSTS instructs browsers to always use HTTPS for the domain. A strong policy needs max-age >= 15552000 (180 days); preloading additionally requires max-age >= 31536000, includeSubDomains, and the preload directive.
The HSTS header is present but missing: preload.
HSTS preload requires all three directives. The current header provides some protection but is not eligible for browser preloading.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
An A record maps the domain to an IPv4 address.
No action required.
An AAAA record maps the domain to an IPv6 address. IPv6 is recommended but not mandatory.
No IPv6 AAAA record was found for the domain.
IPv6 is recommended for future-proofing but not mandatory. Many networks still work without it.
Name: @ Type: AAAA Value: <your-public-IPv6> TTL: 3600
NS records identify the authoritative nameservers for the domain.
No action required.
TTL controls how long resolvers cache a record. Very low TTLs increase DNS query load and defeat failover caching; very high TTLs delay migrations and disaster recovery.
No action required.
CAA records restrict which certificate authorities can issue certificates for this domain, blocking unauthorized issuance (PCI DSS 4.2.1). Without them, any CA may issue.
No CAA records were found for yasen.lindeas.com.
Without CAA records, any certificate authority may issue certificates for this domain. CAA restricts issuance to the CA(s) you name, blocking unauthorized or mistaken issuance — including from compromised or mis-operated CAs. Note: a CAA record on a parent domain (e.g. the zone apex) also covers this name.
; name TTL class type flags tag value @ 3600 IN CAA 0 issue "letsencrypt.org" @ 3600 IN CAA 0 issuewild "letsencrypt.org" @ 3600 IN CAA 0 iodef "mailto:security@yasen.lindeas.com"
DNSSEC cryptographically signs DNS records so resolvers can detect forged or poisoned answers (PCI DSS 4.1).
RFC 4033 — DNSSEC intro · DNSViz — visualize the chain · PCI DSS v4.0
No DS or DNSKEY records were found for yasen.lindeas.com, and DreamHost's nameservers do not support DNSSEC signing.
DNSSEC cryptographically signs DNS responses so validating resolvers detect forged or poisoned answers. Unsigned zones can be spoofed by anyone able to inject DNS replies (PCI DSS 4.1).
A wildcard record answers for every subdomain name that does not exist in the zone. It can mask subdomain takeover findings — a dangling CNAME and the wildcard catch-all resolve identically — and a wildcard MX accepts mail on arbitrary subdomains, making per-subdomain email validation meaningless.
No action required.
Every CNAME hop costs the resolver an extra lookup before the final address arrives — deep chains add latency, and a chain that points back into itself never resolves, breaking the name entirely.
RFC 1034 §3.6.2 — CNAME · RFC 2181 §10.3 — CNAME restrictions
No action required.
Nameserver software often answers the CHAOS-class version.bind query with its exact version string. That hands fingerprint data to anyone asking — matching the server to known exploits and tracking unpatched infrastructure — while serving no operational purpose to visitors.
No action required.
A subdomain pointing at a decommissioned third-party service can be claimed by anyone — the attacker then hosts arbitrary content under the domain's name: phishing pages that inherit its reputation, session-cookie theft when cookies are scoped to the parent domain, or malware delivery. Dangling CNAMEs are the most common cause; deleting the DNS record removes the risk entirely.
OWASP — subdomain takeover · can-i-take-over-xyz — service matrix
No action required.
Domain registration data was retrieved successfully.
No action required.
A domain's A/AAAA answers are served from networks someone operates — the ASN and its owner name tell you who actually hosts the site, and the abuse contact is where reports about it land. Registered block owner and announcing AS can legitimately differ.
No action required — this is informational context.
MX records specify which mail servers receive email for the domain.
This is optional and does not affect the score.
Security headers protect against XSS, clickjacking, MIME sniffing, and other common web vulnerabilities.
Missing: Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Frame Protection.
Security headers protect against XSS, clickjacking, MIME sniffing, and other common web vulnerabilities.
add_header Content-Security-Policy "default-src 'self'"; add_header X-Content-Type-Options "nosniff"; add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Permissions-Policy "geolocation=(), microphone=(), camera=()"; add_header X-Frame-Options "SAMEORIGIN";
Header always set Content-Security-Policy "default-src 'self'" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()" Header always set X-Frame-Options "SAMEORIGIN"
A Content-Security-Policy restricts which resources the browser may load and is one of the strongest defences against cross-site scripting (XSS).
MDN — Content-Security-Policy · CSP Evaluator · PCI DSS v4.0
Add a Content-Security-Policy header — see the Security Headers recommendation.
Cross-Origin Resource Sharing headers decide which websites may read this response in a visitor's browser. Reflected-origin misconfigurations need an intrusive probe to detect.
No action required. Add CORS headers only if other sites legitimately need to fetch this content.
Cache-Control, ETag and Last-Modified tell browsers and shared caches what may be stored and for how long. Checked on the homepage response only — static assets may have a different policy.
No action required.
HTTPS pages that load resources over plain HTTP expose users to tampering and downgrade attacks; browsers block active mixed content entirely.
No action required.
Third-party scripts and stylesheets execute with your page's full privileges — if a CDN is compromised or its content swapped, injected code runs on your site. An integrity= hash makes the browser reject tampered resources (PCI DSS Req 6.4.3 requires an integrity mechanism for payment-page scripts).
MDN — Subresource Integrity · W3C — Subresource Integrity spec · PCI DSS v4.0
7 third-party script(s)/stylesheet(s) load without an integrity attribute.
Third-party code executes with the page's full privileges — a compromised CDN or swapped asset injects arbitrary JavaScript into your site. An integrity hash makes the browser verify the bytes and refuse tampered content (PCI DSS Req 6.4.3 requires an integrity mechanism for payment-page scripts).
curl -s https://cdn.example.com/lib.js | openssl dgst -sha384 -binary | openssl base64 -A
<script src="https://cdn.example.com/lib@1.2.3/lib.js"
integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
crossorigin="anonymous"></script>
Secure and HttpOnly are set; only SameSite is absent. All major browsers treat a missing SameSite attribute as SameSite=Lax by default (RFC 6265bis), so cross-site requests already do not send these cookies — setting it explicitly documents intent and covers legacy clients.
1 cookie(s) — wordpress_test_cookie. Missing: SameSite.
Only the SameSite attribute is absent. All major browsers have treated a missing SameSite as SameSite=Lax by default since ~2020 (RFC 6265bis), so cross-site requests already do not send these cookies — this is low-priority hardening rather than an active vulnerability.
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax
# Rewrite flags onto every Set-Cookie passing through proxy_cookie_flags ~ secure samesite=lax httponly;
Header always edit Set-Cookie ^(.*)$ "$1; Secure; HttpOnly; SameSite=Lax"
Revealing server versions, frameworks, directory listings, or verbose errors can help attackers choose exploits.
No action required.
Debug mode and displayed errors leak stack traces, file paths, environment variables, and sometimes credentials — a map for attackers. The pages we fetched showed none of it.
OWASP — improper error handling · OWASP WSTG — error handling
No action required.
A Web Application Firewall (WAF) or bot-mitigation layer filters traffic before it reaches the application — including automated scanners. Detection is informational and does not affect the score.
No action required.
A security.txt file gives security researchers a standard, machine-readable way to find your disclosure contact — so a real vulnerability report reaches you instead of landing in a public issue tracker or an abandoned inbox.
RFC 9116 — security.txt · securitytxt.org — generator & field guide
Publish /.well-known/security.txt over HTTPS with at least one Contact: URI (mailto: or a web form) and an Expires: timestamp — RFC 9116 defines the format; securitytxt.org has a generator.
HTTP/2 and HTTP/3 improve page load performance through multiplexing and lower latency. This check is informational and does not affect the score.
The site answered over HTTP/1.x — HTTP/2 was not negotiated.
HTTP/2 multiplexes many requests over one connection and compresses headers, which noticeably improves load times on pages with many resources. All modern browsers support it and fall back to HTTP/1.1 cleanly, so enabling it is safe. HTTP/3 (QUIC over UDP 443) is a further step — supported natively by Caddy and LiteSpeed, in nginx ≥ 1.25.1 via the ngx_http_v3 module, and by all major CDNs. Apache httpd has no stable HTTP/3 support; front it with a CDN or reverse proxy instead.
Enable HTTP/2 on the HTTPS listener (it is negotiated via ALPN during the TLS handshake). Consult your server's documentation for the exact directive — it is one line on nginx, Apache, Caddy, LiteSpeed and IIS.
Search engines index what the page itself declares: title and meta description shape the result snippet, the viewport tag signals mobile-readiness, and meta/X-Robots-Tag directives can quietly exclude the page from indexes entirely.
Google — SEO starter guide · schema.org — structured data · RFC 9309 — Robots Exclusion Protocol
Missing: Meta description; off-band: Title tag.
Title and meta description control the snippet searchers see — weak or missing ones mean low click-through even when the page ranks. A missing viewport tag fails Google's mobile-friendly requirement, and a missing/multiple h1 leaves the page's topic under-declared.
<title>Fresh pasta recipes — Nonna's Kitchen</title> <meta name="description" content="Sixty handmade pasta recipes with step photos, from tagliatelle to ravioli."> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="canonical" href="https://example.com/recipes">
Search engines rank what they can read. Server-side text is the content they index — a page that ships an empty body for JavaScript to fill may index as blank, thin pages struggle to rank, and heading order plus language hints help crawlers (and screen readers) understand the page.
Google — creating helpful content · Google — JavaScript SEO basics
Optional: add alt text to the missing image(s); switch internal links to https:// or relative URLs.
When the page is shared, Open Graph and Twitter Card tags decide the preview image and text — without them links render bare. Structured data (schema.org JSON-LD or microdata) makes pages eligible for rich results, but only blocks that actually parse count.
schema.org — structured data · Open Graph protocol · Twitter Cards — docs
No action required.
Search visibility compounds with presence: engines trust domains with crawl history, webmaster consoles are where crawl and index data lives, AI-crawler rules decide whether the site appears in AI answers, and third-party indexes are a floor-level check that the wider web sees the domain at all.
Google Search Console · Wayback Machine · Tranco list · Common Crawl
Optional: verify the domain in Google Search Console or Bing Webmaster Tools — a DNS TXT record or a <meta> tag in the page head takes minutes.
Intrusive checks require an account, plus proof that you control this domain — publish a token on the host and verify it.
Sign in / Sign upA live badge for the domain's own site. It shows the verified score while monitoring stays healthy. How it works
It only lights up on yasen.lindeas.com
(the domain or its www host)
Embedded anywhere else it shows "not verified".
Compact badge:
Markdown:
Large badge (with logo):
Markdown:
Please enter the characters from the image to continue.
Sign up free and yasen.lindeas.com lands back in the form ready to scan.