Sample audit result: 65/100

This is an example. The domain firma-przyklad.pl does not exist, and the findings were computed by the same scanner on prepared data. Your company gets the same page with its own results.

What this means for the business

Public sources show parts of your infrastructure that make it easier to pick a target.

Company email is less protected: it is easier to send a message that looks like it came from your company, and real messages land in spam more often.

Most important fixes

Subdomain takeover risk critical
1 DNS record points to a name that does not exist (e.g. stary-sklep.firma-przyklad.pl → firma-przyklad-sklep.hostingsklepow.example). Someone can register the target and serve content under your subdomain. Remove the abandoned DNS records.
If a subdomain points (CNAME) to a name that does not exist or to an inactive service, an outsider can register it and serve their own content under your address (phishing, malicious scripts).
How to fix: Remove DNS records that point to services you no longer use.
DMARC: record critical
No DMARC record - anyone can send messages "from" this domain, and receivers get no instruction on what to do with them.
DMARC ties SPF and DKIM together and tells receiving servers what to do with spoofed email. Without it, someone can send invoices "from you".
How to fix: Add a TXT record _dmarc.<domain>: v=DMARC1; p=none; rua=mailto:… - start with monitoring.
Guide: how to fix it step by step
Can your company be impersonated critical
Anyone can send a message that looks like it is "from your company" and it will reach the recipient's inbox (a customer or a business partner). There is no effective DMARC policy. This is the main mechanism of "fake invoice" fraud.
Without an effective DMARC, anyone can send an email that looks like it comes "from your company" to your customers and partners. This is how fake invoice and bank account change scams work.
How to fix: Fix SPF and DKIM, then set the DMARC policy to quarantine, then reject.
Guide: how to fix it step by step

Step-by-step instructions for email and DNS providers: guides. Checking the record itself: SPF, DMARC.

What an attacker sees

They can send a message with a sender address in your domain, and the receiving server is not told to reject it.
They see a subdomain pointing to a service that no longer exists; such a name can sometimes be taken over to serve their own content.
They can use an already registered domain with a typo of your name to impersonate your company by email or on a website.

Next step

Start with the first fix on the list. After the change, run the scan again: the result will show whether it worked.

We checked 67 settings from the outside in these areas: email and spoofing, attack surface, brand protection, website, domain and DNS, privacy and GDPR. Anyone on the internet sees them the same way, without logging in or access to the server. 2 checks could not be run, so they are not part of the score.

Email and spoofing 77/100

SPF, DKIM, DMARC, MTA-STS, mail server encryption.

DMARC: record critical
No DMARC record - anyone can send messages "from" this domain, and receivers get no instruction on what to do with them.

Fix guide
MTA-STS needs attention
No MTA-STS - encryption when receiving email is not enforced (recommended for companies).

Fix guide
TLS-RPT needs attention
No TLS-RPT (reports on TLS errors during delivery).

Fix guide
DMARC: policy not checked
There is no DMARC record to assess.
DMARC: reports not checked
There is no DMARC record to assess.

No issues: 7

Mail servers (MX) OK
Email: Google Workspace
SPF: record OK
An SPF record exists and its syntax is valid.
SPF: "all" policy OK
"-all": email from outside the list is rejected.
SPF: DNS lookup limit OK
1 of 10 allowed DNS lookups.
DKIM: message signature OK
DKIM: google (rsa 2048)
Encryption on the MX server (STARTTLS) OK
Email at a large provider (Google Workspace) - STARTTLS and certificates are standard there (we do not probe).
Reverse record (PTR) of the MX server OK
PTR 93.184.216.34 → aspmx.l.google.com.

Attack surface 51/100

Subdomains from certificate logs, subdomain takeover risk, secrets in the website code, script integrity.

Subdomain takeover risk critical
1 DNS record points to a name that does not exist (e.g. stary-sklep.firma-przyklad.pl → firma-przyklad-sklep.hostingsklepow.example). Someone can register the target and serve content under your subdomain. Remove the abandoned DNS records.
Subdomains in certificate logs to verify
The public certificate logs list subdomains (4), including names typical of test environments or admin panels: test.firma-przyklad.pl. Check whether they should be reachable from the internet and whether they are protected.
Script integrity (SRI) needs attention
1 script loaded from external servers (cdn.przyklad-widget.example) without integrity protection (SRI). If one of those servers is taken over, it can replace the script on your site.

No issues: 1

Secrets in the page code OK
No secrets found in the page code (scripts from this domain reviewed: 0).

Brand protection 20/100

Whether someone can send email as your company; registered domains that look like yours.

Can your company be impersonated critical
Anyone can send a message that looks like it is "from your company" and it will reach the recipient's inbox (a customer or a business partner). There is no effective DMARC policy. This is the main mechanism of "fake invoice" fraud.

Fix guide
Lookalike domains to verify
Registered names differ from yours by a typo, a look-alike character or an added word: frma-przyklad.pl. Check whether they are yours. Someone else's domain of this kind can be used to impersonate the company. The same name with a different ending is registered: firma-przyklad.com. These may be your domains or other companies with the same name.

Fix guide
Similar domains with email to verify
Email is configured (MX record) on similar domains: frma-przyklad.pl, firma-przyklad.com. If they are not yours, they can be used for correspondence impersonating your company. An MX record alone does not prove bad intent.

Fix guide

Website 90/100

HTTPS, certificate, security headers, cookies, CMS version.

Content-Security-Policy needs attention
No Content-Security-Policy (protection against script injection).
security.txt needs attention
No /.well-known/security.txt (how to report a security hole to you).
Permissions-Policy needs attention
No Permissions-Policy.

No issues: 18

Content management system info
CMS not recognised.
Sensitive files reachable from the internet info
Outside the scope of this scan: we check sensitive paths (backups, configuration files) only for domains with confirmed ownership.
WordPress version info
Not applicable: the site is not WordPress.
HTTPS works OK
HTTPS works (https://firma-przyklad.pl/).
HTTP → HTTPS redirect OK
HTTP redirects to HTTPS.
TLS certificate OK
The certificate is valid for 63 more days (Let's Encrypt), TLSv1.3.
Old TLS versions OK
The server rejects TLS 1.0/1.1.
HSTS OK
HSTS enabled (max-age ≥ 180 days).
X-Content-Type-Options OK
X-Content-Type-Options: nosniff.
Clickjacking protection OK
Embedding in frames is restricted (clickjacking).
Referrer-Policy OK
Referrer-Policy: strict-origin-when-cross-origin.
Cookie flags OK
The site sets no cookies on entry.
Software version disclosure OK
Headers do not reveal software versions.
Mixed content OK
No mixed content.
Home page size OK
Home page HTML: 1 KB.
Server response time OK
Time to first byte: 120 ms.
Address with and without www. OK
The address works with and without "www.".
IPv6 OK
The site has an IPv6 address.

Domain and DNS 65/100

Expiry date, DNSSEC, name servers, CAA.

DNSSEC needs attention
No DNSSEC - the DNS answers of the domain are not signed (an address can be spoofed on unprotected networks).
CAA record needs attention
No CAA record (any certificate authority can issue a certificate for the domain).

No issues: 3

Registry data info
Registrar: Rejestrator Przykładowy; statuses: active.
Domain expiry date OK
The domain firma-przyklad.pl is valid for 123 more days (2027-03-14).
Name servers OK
2 name servers (Cloudflare).

Privacy and GDPR 86/100

Privacy policy, cookies and trackers, company details.

Notice next to the form needs attention
The form has no GDPR information notice and no consent field.

No issues: 5

Shop terms and conditions info
Not applicable: the site does not look like a shop.
Third-party resources info
1 third-party domains loaded on the page.
Privacy policy OK
Link to the privacy policy on the home page.
Consent for cookies and trackers OK
No third-party tracking scripts detected.
Company details on the site OK
Company identification details (NIP/KRS/REGON) are on the home page.

Search visibility 87/100

Not part of the security score: title, description, robots, sitemap, mobile version.

Open Graph needs attention
No Open Graph tags - a link to the site has no nice preview.
Structured data needs attention
No JSON-LD structured data (Organization or LocalBusiness for a company, Person for a personal site, SoftwareApplication or Product for a product).

No issues: 9

Page title OK
Title: "Firma Przykład - biuro rachunkowe w Poznaniu".
Meta description OK
Meta description of a good length.
H1 heading OK
One H1 heading: "Firma Przykład".
Canonical link OK
Canonical link is set.
Page language OK
Page language: pl.
Mobile version (viewport) OK
Meta viewport (mobile version).
Home page indexing OK
The home page can be indexed.
robots.txt OK
robots.txt exists.
Sitemap OK
Sitemap listed in robots.txt (https://firma-przyklad.pl/sitemap.xml).

Website accessibility 93/100

Not part of the security score: WCAG basics that can be checked automatically.

"Skip to content" link needs attention
No "skip to content" link for keyboard users.

No issues: 6

Image descriptions (alt) OK
All images (1) have an alt attribute.
Document language OK
Document language is declared.
Form field labels OK
All fields (1) have labels.
Heading structure OK
Headings start with H1 and do not skip levels.
Page title OK
The page has a title.
Zoom on mobile OK
Zooming on a phone is not blocked.

How to read the result

Each check has a weight; an area score is the points earned divided by the points possible. The overall score is a weighted average of the areas: email and spoofing 24 %, attack surface 22 %, brand protection 14 %, website 18 %, domain and DNS 14 %, privacy and GDPR 8 %.

Letter grade: A from 90, B from 80, C from 65, D from 50, E below 50 points; a critical issue lowers the letter to D at most, and the ring and the area bar then turn the alarm color. A dimmed green bar means some checks in the area could not be run. Google visibility and site availability are shown separately, outside the security grade. Checks marked "not checked" do not count toward the score. Full list of checks with weights: method.

Check another domain