SAMPLE REPORT
This is a real report from our scanner. The target, https://demo-shop.example/, is a deliberately misconfigured demo shop that we built for this purpose, so no real website is exposed here. Nothing in it has been edited.
Starts at 100 and deducts 25 per high, 10 per medium, 4 per low and 1 per informational issue, counting a repeated issue once; any high finding caps the score at 59. It reflects only the automated checks that ran, not the overall security of the website or code.
From response headers, cookie names, page markup and loaded files on the pages we crawled, plus public DNS records and the certificate. Signatures can be hidden or faked.
highEnvironment file is publicly readable
https://demo-shop.example/.env
The response at this address matched the expected format. Its content is intentionally omitted.
Next step: Block access to dotfiles, move the file outside the web root and rotate every credential it contains.
mediumHTTP resources referenced by an HTTPS page
7 pages, first seen on https://demo-shop.example/
1 resource references use HTTP.
Next step: Use HTTPS for scripts, styles, images and embedded frames.
mediumOutdated jQuery 1.12.4
https://demo-shop.example/
jQuery before 3.5.0 has published cross-site scripting advisories (CVE-2020-11022, CVE-2020-11023) in its HTML handling. Detected from: loads /assets/js/jquery-1.12.4.min.js.
Next step: Upgrade jQuery to the current 3.x release and retest any plugins that depend on it.
lowHSTS needs configuration
11 pages, first seen on https://demo-shop.example/
Header missing or ineffective on the scanned response.
Next step: Set Strict-Transport-Security after confirming all affected hosts support HTTPS.
lowContent Security Policy needs configuration
11 pages, first seen on https://demo-shop.example/
Header missing or ineffective on the scanned response.
Next step: Deploy a Content-Security-Policy tailored to the site. Start in report-only mode and remove unnecessary script origins.
lowNo clickjacking protection observed
11 pages, first seen on https://demo-shop.example/
No X-Frame-Options restriction or CSP frame-ancestors directive.
Next step: Set frame-ancestors in CSP according to where this page may be embedded.
lowReview cookie security attributes
11 pages, first seen on https://demo-shop.example/
Missing attributes: secure, httponly, samesite. Cookie names and values are omitted.
Next step: For session or sensitive cookies, use Secure, HttpOnly and an appropriate SameSite policy. JavaScript-readable preference cookies may be intentional.
lowAPI description is publicly readable
https://demo-shop.example/openapi.json
The response at this address matched the expected format. Its content is intentionally omitted.
Next step: Public API documentation can be intentional. Confirm that every listed endpoint enforces authentication and authorisation, and remove the description from production if it is not meant to be public.
lowInteractive API documentation is public
https://demo-shop.example/docs
The response at this address matched the expected format. Its content is intentionally omitted.
Next step: Public API documentation can be intentional. Confirm that every listed endpoint enforces authentication and authorisation, and remove the description from production if it is not meant to be public.
lowNo DMARC policy for email
DNS for demo-shop.example
No v=DMARC1 record at _dmarc.demo-shop.example, so mail forged in your name is not reported or rejected.
Next step: Publish _dmarc.demo-shop.example TXT "v=DMARC1; p=none; rua=mailto:<reports address>", review the reports, then move to p=quarantine or p=reject.
infoReferrer policy needs configuration
11 pages, first seen on https://demo-shop.example/
Header missing or ineffective on the scanned response.
Next step: Set a deliberate Referrer-Policy, such as strict-origin-when-cross-origin.
infoNo bot protection observed on a form
2 pages, first seen on https://demo-shop.example/login
1 form(s) that accept a password, email address or message, with no CAPTCHA or challenge marker in the page.
Next step: Confirm that sign-in, sign-up and contact forms are rate limited or protected by a challenge. Server-side controls are not visible to this scan.
inforobots.txt advertises sensitive-looking paths
https://demo-shop.example/robots.txt
2 disallowed path(s) look sensitive, for example: /admin-backup/, /internal/reports/.
Next step: robots.txt is public and is not access control. Protect these paths with authentication and avoid listing ones that should stay unknown.
infoNo security.txt contact published
https://demo-shop.example/.well-known/security.txt
No security.txt with a Contact field was found.
Next step: Publish /.well-known/security.txt so researchers know how to report a vulnerability to you.
infoServer software versions disclosed
https://demo-shop.example/
Response headers reveal exact versions (Server: nginx/1.18.0; X-Powered-By: PHP/7.4.3), which makes it easier to match the site against known vulnerabilities.
Next step: Remove version numbers from Server and X-Powered-By headers (for example server_tokens off in Nginx, expose_php = Off in PHP) and keep the software patched.
11 pages fetched from demo-shop.example by following same-site links, at most 3 links from the entry page. The header checks below describe the entry page; each finding lists the pages it was seen on.
Final response: HTTP 200. Certificate verified; negotiated TLSv1.3.
Header missing or ineffective on this response.
Header missing or ineffective on this response.
Header observed (policy effectiveness needs contextual review).
Header missing or ineffective on this response.
No framing restriction observed.
1 cookies observed on this public response. Authenticated session cookies were not tested.
Inspected resource URLs in returned HTML only; JavaScript-created resources are outside coverage.
Requested 17 of 17 well-known addresses for configuration files, repository metadata, status pages, API descriptions and GraphQL. Only fixed addresses are tried; unlinked or custom API paths are not discovered and no API call is made.
robots.txt found. It has no rules naming common AI crawlers. Forms on crawled pages were checked for a visible CAPTCHA or challenge marker. Server-side bot detection and rate limiting cannot be observed from outside.
Read the public MX, SPF and DMARC records for demo-shop.example. DKIM keys use per-service names and cannot be listed from outside.
14 technologies identified from headers, cookie names, markup, loaded files, public DNS records and the certificate. Only what is publicly visible is listed.
Up to 15 public pages on one host, discovered by following same-site links from the entry page. A fixed list of well-known addresses is also requested to look for exposed files and API descriptions. GET requests only; the crawl honours robots.txt. Public DNS records (MX, SPF, DMARC and name servers) are read for the technology profile and email checks. No authentication, form submission, injection, brute force or access-control testing.
Automated assessment, not a penetration test or security certification. Findings require review in the context of your application.
