SAMPLE SECURITY REPORT · EXAMPLE DATA

Threat model

Illustrative passive security report for a fictional business, with invented findings. This page is not a current assessment, a full penetration test or a security certification.

acme-plumbing.example

🛡️ Findings (12 total)

🔴 CRITICAL DMARC record missing

Without DMARC, receiving mail servers get no policy for mail that fails SPF or DKIM checks, so mail that spoofs your domain is more likely to reach your customers' inboxes.

Fix: Add a TXT record at _dmarc.acme-plumbing.example: "v=DMARC1; p=quarantine; rua=mailto:[email protected]" (start with p=quarantine, move to p=reject after 30 days).

🔴 CRITICAL 8 sensitive path(s) publicly accessible

Found: /.env, /.git/HEAD, /wp-admin/install.php, /config.php, /phpinfo.php, /server-status, /.aws/credentials, /backup.zip. These can leak API keys, source code, or admin credentials.

Fix: Configure nginx/Apache to deny access to dotfiles and known sensitive paths. Move secrets out of webroot.

🔵 MEDIUM Content-Security-Policy header missing

No CSP means injected scripts can run from any origin — XSS attacks succeed if any input is mis-escaped.

Fix: Start with a permissive CSP: `Content-Security-Policy: default-src 'self' https:; script-src 'self' https: 'unsafe-inline';`

🔵 MEDIUM X-Frame-Options header missing

Without X-Frame-Options, your site can be embedded in an iframe and used for clickjacking attacks.

Fix: Add response header: `X-Frame-Options: SAMEORIGIN`

🔵 MEDIUM X-Content-Type-Options header missing

Without this header, browsers may execute uploaded files as JavaScript via MIME-sniffing.

Fix: Add response header: `X-Content-Type-Options: nosniff`

🔵 MEDIUM Referrer-Policy header missing

Default browser behavior leaks full URLs (including form data) to external sites you link to.

Fix: Add response header: `Referrer-Policy: strict-origin-when-cross-origin`

🔵 MEDIUM DKIM record not found at common selectors

Tried selectors: default, google, selector1, k1, mailo, smtpapi. DKIM signs outgoing emails so receivers can verify they're really from you. Without DKIM, your bulk emails (invoices, quotes) hit spam more often.

Fix: Enable DKIM in your email provider's dashboard (Google Workspace, Microsoft 365, Mailgun, etc.). Add the published TXT record to DNS.

✅ INFO Strict-Transport-Security configured

Value: "max-age=31536000; includeSubDomains; preload"

✅ INFO Permissions-Policy header missing

Modern replacement for Feature-Policy. Locks down camera/microphone/geolocation/USB access.

Fix: Add response header: `Permissions-Policy: geolocation=(), microphone=(), camera=()`

✅ INFO SPF configured

Example record: v=spf1 include:_spf.mail.example ~all

✅ INFO SSL certificate valid

Example: the certificate had 35 days left at the time of the check.

✅ INFO Subdomain check not run

This example ran the quick check only, so subdomains were not listed.

Want to see where your own site stands?

In this example, items with a Fix line say what to change. Start with a free AI-visibility check of your own site.

Check my site free →