📋 This is an example report — showing what a perfect Security Audit looks like. Run your own audit →
Security Audit Example: All 23 Passive Checks Passing
100
Security Score (out of 100)
23 of 23 checks passed
example-secure-site.com
What this report shows. This example demonstrates a website with every passive security check passing — strong HTTP security headers, a valid modern TLS configuration, cookies set with all three security flags, no mixed content, hidden server fingerprints, no known CVEs against detected software versions, no CMS version exposure, full mail security DNS records (SPF, DMARC, DKIM), and both standard well-known files in place. Read the full guide for the fix instructions behind each check, or jump to the beginner tutorial for a step-by-step walkthrough.
🔐 HTTP Security Headers
✅
Content-Security-Policy
CSP header — defends against XSS and injection by restricting which resources can load.
OWASP A05:2021CWE-693
PASS
✅
Strict-Transport-Security (HSTS)
HSTS forces browsers to use HTTPS, preventing protocol downgrade attacks.
OWASP A02:2021CWE-319
PASS
✅
X-Frame-Options / frame-ancestors
Prevents your site being embedded in iframes (clickjacking defence).
OWASP A05:2021CWE-1021
PASS
✅
X-Content-Type-Options
Stops browsers from MIME-sniffing responses, which can lead to XSS.
OWASP A05:2021CWE-430
PASS
✅
Referrer-Policy
Controls how much referrer info is sent to other sites. Protects user privacy.
OWASP A05:2021CWE-200
PASS
✅
Permissions-Policy
Restricts which browser features (camera, mic, geolocation) the page can use.
OWASP A05:2021CWE-693
PASS
🔒 TLS / SSL
✅
TLS Certificate Valid
Certificate is valid, not expired and signed by a trusted CA.
OWASP A02:2021CWE-295
PASS
✅
TLS Certificate Not Expiring Soon — expires 2027-01-15
Certificate is not expiring in the next 30 days.
OWASP A02:2021CWE-324
PASS
✅
TLS Protocol Modern — TLSv1.3
Server negotiates TLS 1.2 or 1.3 (not deprecated TLS 1.0 / 1.1).
OWASP A02:2021CWE-326
PASS
🍪 Cookies
✅
Cookies use Secure flag
All Set-Cookie responses include the Secure flag.
OWASP A05:2021CWE-614
PASS
✅
Cookies use HttpOnly flag
Cookies not readable from JavaScript, preventing theft via XSS.
OWASP A05:2021CWE-1004
PASS
✅
Cookies use SameSite attribute
Cookies declare SameSite (Lax or Strict) to mitigate CSRF.
OWASP A01:2021CWE-1275
PASS
⚠ Mixed Content
✅
No mixed content
HTTPS pages do not load any http:// resources.
OWASP A02:2021CWE-319
PASS
🖥 Server Fingerprint
✅
Server header not verbose — nginx
Server header does not advertise exact version.
OWASP A05:2021CWE-200
PASS
✅
X-Powered-By header absent
X-Powered-By header not exposed.
OWASP A05:2021CWE-200
PASS
📚 Known CVEs (NVD)
✅
No known CVEs detected — no version fingerprints to lookup
No CVEs matched against detected versions via NIST NVD.
OWASP A06:2021CWE-1104
PASS
📦 CMS Detection
✅
CMS not exposing version — no CMS detected
No CMS generator meta tag exposing the exact version.
OWASP A05:2021CWE-200
PASS
📧 Mail Security DNS
✅
SPF record present — apex: example-secure-site.com
DNS TXT record starting v=spf1 — authorises which servers can send mail.
OWASP A07:2021CWE-290
PASS
✅
DMARC record present — apex: example-secure-site.com
_dmarc.<domain> TXT record exists — protects from spoofing/phishing.
OWASP A07:2021CWE-290
PASS
✅
DKIM signature on common selector — selector: default
At least one common DKIM selector resolves.
OWASP A07:2021CWE-290
PASS
📄 robots.txt / security.txt
✅
robots.txt present
A robots.txt is published at /robots.txt.
PASS
✅
security.txt present
A security.txt is published at /.well-known/security.txt (RFC 9116).
PASS
🛡 How does your site score?
Run a free passive security audit on your own domain in seconds. All 23 checks across 9 families — HTTP headers, TLS, cookies, mixed content, server fingerprint, CVEs via NVD, CMS, mail DNS and well-known files.