Security Audit Example: All 23 Passive Checks Passing

100

Security Score (out of 100)

23 of 23 checks passed

example-secure-site.com

What this report shows. This example demonstrates a website with every passive security check passing — strong HTTP security headers, a valid modern TLS configuration, cookies set with all three security flags, no mixed content, hidden server fingerprints, no known CVEs against detected software versions, no CMS version exposure, full mail security DNS records (SPF, DMARC, DKIM), and both standard well-known files in place. Read the full guide for the fix instructions behind each check, or jump to the beginner tutorial for a step-by-step walkthrough.

🔐 HTTP Security Headers

✅

Content-Security-Policy

CSP header — defends against XSS and injection by restricting which resources can load.

OWASP A05:2021CWE-693

PASS

✅

Strict-Transport-Security (HSTS)

HSTS forces browsers to use HTTPS, preventing protocol downgrade attacks.

OWASP A02:2021CWE-319

PASS

✅

X-Frame-Options / frame-ancestors

Prevents your site being embedded in iframes (clickjacking defence).

OWASP A05:2021CWE-1021

PASS

✅

X-Content-Type-Options

Stops browsers from MIME-sniffing responses, which can lead to XSS.

OWASP A05:2021CWE-430

PASS

✅

Referrer-Policy

Controls how much referrer info is sent to other sites. Protects user privacy.

OWASP A05:2021CWE-200

PASS

✅

Permissions-Policy

Restricts which browser features (camera, mic, geolocation) the page can use.

OWASP A05:2021CWE-693

PASS

🔒 TLS / SSL

✅

TLS Certificate Valid

Certificate is valid, not expired and signed by a trusted CA.

OWASP A02:2021CWE-295

PASS

✅

TLS Certificate Not Expiring Soon — expires 2027-01-15

Certificate is not expiring in the next 30 days.

OWASP A02:2021CWE-324

PASS

✅

TLS Protocol Modern — TLSv1.3

Server negotiates TLS 1.2 or 1.3 (not deprecated TLS 1.0 / 1.1).

OWASP A02:2021CWE-326

PASS

🍪 Cookies

✅

Cookies use Secure flag

All Set-Cookie responses include the Secure flag.

OWASP A05:2021CWE-614

PASS

✅

Cookies use HttpOnly flag

Cookies not readable from JavaScript, preventing theft via XSS.

OWASP A05:2021CWE-1004

PASS

✅

Cookies use SameSite attribute

Cookies declare SameSite (Lax or Strict) to mitigate CSRF.

OWASP A01:2021CWE-1275

PASS

⚠ Mixed Content

✅

No mixed content

HTTPS pages do not load any http:// resources.

OWASP A02:2021CWE-319

PASS

🖥 Server Fingerprint

✅

Server header not verbose — nginx

Server header does not advertise exact version.

OWASP A05:2021CWE-200

PASS

✅

X-Powered-By header absent

X-Powered-By header not exposed.

OWASP A05:2021CWE-200

PASS

📚 Known CVEs (NVD)

✅

No known CVEs detected — no version fingerprints to lookup

No CVEs matched against detected versions via NIST NVD.

OWASP A06:2021CWE-1104

PASS

📦 CMS Detection

✅

CMS not exposing version — no CMS detected

No CMS generator meta tag exposing the exact version.

OWASP A05:2021CWE-200

PASS

📧 Mail Security DNS

✅

SPF record present — apex: example-secure-site.com

DNS TXT record starting v=spf1 — authorises which servers can send mail.

OWASP A07:2021CWE-290

PASS

✅

DMARC record present — apex: example-secure-site.com

_dmarc.<domain> TXT record exists — protects from spoofing/phishing.

OWASP A07:2021CWE-290

PASS

✅

DKIM signature on common selector — selector: default

At least one common DKIM selector resolves.

OWASP A07:2021CWE-290

PASS

📄 robots.txt / security.txt

✅

robots.txt present

A robots.txt is published at /robots.txt.

PASS

✅

security.txt present

A security.txt is published at /.well-known/security.txt (RFC 9116).

PASS

🛡 How does your site score?

Run a free passive security audit on your own domain in seconds. All 23 checks across 9 families — HTTP headers, TLS, cookies, mixed content, server fingerprint, CVEs via NVD, CMS, mail DNS and well-known files.

Run your audit →

Security Audit Example: All 23 Passive Checks Passing

🛡 How does your site score?

About aiwebpageseo