Security report
acme-store.example
completed
01 Nov 2026, 10:15 UTC
Took 60 s
Full report
21
Grade F
At risk
- acme-store.example scored 21 out of 100 (grade F, at risk).
- We ran 89 checks: 75 passed and 14 issues were found: 2 critical, 1 high, 3 medium, 8 low.
- Fix first: PHP 7.4.3: 1 actively exploited vulnerability; Git repository exposed.
- The largest share of lost points is in known vulnerabilities (-30).
- 7 of the issues are quick fixes that usually take less than an hour each.
- Since the previous scan on 2026-10-02 the score is up by 13 points: 2 issues resolved, 2 new.
2 critical
1 high
3 medium
8 low
75/89 checks passed
+13 since 2026-10-02
Security areas
Score = 100 − points lost in each areaChanges since 2026-10-02
Score 8 → 21 (+13)
Resolved (2)
- Served over plaintext HTTP
- No DMARC record
New (2)
- DMARC is in monitoring mode (p=none)
- Certificate expires in 19 days
Action plan
6 quick winsFix now
Confirmed critical and high risks
PHP 7.4.3: 1 actively exploited vulnerability
Moderate · a few hours
Git repository exposed
Moderate · a few hours
Fix this month
Medium risks and unconfirmed CVEs
PHP 7.4.3: 37 known vulnerabilities
Moderate · a few hours
Obsolete protocol enabled: TLSv1.1
Quick fix · under 1 hour
DMARC is in monitoring mode (p=none)
Moderate · a few hours
Missing header: content-security-policy
Moderate · a few hours
Hardening
Low risks and best practice
Certificate expires in 19 days
Quick fix · under 1 hour
DNSSEC is not enabled
Quick fix · under 1 hour
Missing header: x-frame-options
Quick fix · under 1 hour
No CAA record
Quick fix · under 1 hour
No security.txt
Quick fix · under 1 hour
Software version disclosure
Quick fix · under 1 hour
No MTA-STS policy
Moderate · a few hours
Non-production hosts are publicly resolvable
Moderate · a few hours
Findings
Web security 4
medium Missing header: content-security-policy
No Content-Security-Policy, so the browser runs any script that ends up in the page; a single injection flaw becomes a full cross-site scripting attack.
Why it matters
CSP is the safety net against cross-site scripting (XSS), the most common web vulnerability. Without it, one injection bug lets attackers steal sessions, skim card details or deface pages.
Evidence
'content-security-policy' not present in the HTTPS response.
How to fix Moderate · a few hours
- Start in report-only mode to see what the site loads without breaking anything.
- List the script, style, image and font sources the site needs.
- Switch the header from Content-Security-Policy-Report-Only to Content-Security-Policy.
- Reload the web server and re-run the scan to confirm.
nginx (starting point)
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
Apache (report-only first)
Header always set Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; frame-ancestors 'none'"
low Missing header: x-frame-options
No X-Frame-Options (or CSP frame-ancestors), so the page may be framed for clickjacking.
Why it matters
Other sites can load your pages in an invisible frame and trick users into clicking buttons they cannot see (clickjacking) - for example confirming a payment or changing settings.
Evidence
'x-frame-options' not present in the HTTPS response.
How to fix Quick fix · under 1 hour
- Add the header in the web server (or CDN) configuration of the site.
- Use SAMEORIGIN instead of DENY if your own site frames its pages.
- Reload the web server and re-run the scan to confirm.
nginx
add_header X-Frame-Options "DENY" always;
Apache
Header always set X-Frame-Options "DENY"
All recommended headers (nginx)
# inside the server { } block that serves HTTPS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;low No security.txt
There is no published way to report a vulnerability.
Why it matters
Security researchers who find a problem have no clear way to tell you, so the report may never arrive - or the issue is disclosed publicly first.
Evidence
GET https://acme-store.example/.well-known/security.txt did not return a Contact field.
How to fix Quick fix · under 1 hour
- Create /.well-known/security.txt with at least Contact and Expires.
- Use an address that is monitored.
/.well-known/security.txt
Contact: mailto:security@example.com Expires: 2027-12-31T23:59:59Z Preferred-Languages: en
low Software version disclosure
Response headers reveal software versions, which lets an attacker look up exactly which known vulnerabilities apply.
Why it matters
Exact version numbers let attackers look up which public exploits work against your server, and automated tools target vulnerable versions specifically.
Evidence
server: Apache/2.4.29 (Ubuntu) x-powered-by: PHP/7.4.3
How to fix Quick fix · under 1 hour
- Turn off version banners in the web server and the application runtime.
- Keep the software updated - hiding the version is not a replacement for patching.
- Reload the web server and re-run the scan to confirm.
nginx
server_tokens off;
Apache
ServerTokens Prod ServerSignature Off
PHP (php.ini)
expose_php = Off
Data exposure 1
high Git repository exposed
The .git folder is downloadable. Attackers can reconstruct the full source code and its history, which often contains passwords, API keys and internal URLs.
Why it matters
Anyone who requests the file gets it - automated bots look for exactly these paths within hours of a site going live. Leaked credentials lead straight to a data breach.
Evidence
GET https://acme-store.example/.git/HEAD -> 200 Content begins: ref: [redacted]
How to fix Moderate · a few hours
- Delete the file from the web root (or move it outside the public folder).
- Treat every password, key and token in it as compromised: rotate them now.
- Block dot-files and backup files in the web server so it cannot happen again.
- Check the web server access logs for earlier downloads of the path.
nginx
location ~ /\.(?!well-known) { deny all; return 404; }
location ~* \.(bak|sql|old|swp|orig)$ { deny all; return 404; }Apache
<FilesMatch "^\.(?!well-known)">
Require all denied
</FilesMatch>
<FilesMatch "\.(bak|sql|old|swp|orig)$">
Require all denied
</FilesMatch>TLS & certificates 2
medium Obsolete protocol enabled: TLSv1.1
The server completed a handshake using TLSv1.1, which is deprecated and has known weaknesses.
Why it matters
TLS 1.1 is deprecated (RFC 8996) and fails PCI DSS and most security baselines.
Evidence
TLSv1.1 handshake succeeded.
How to fix Quick fix · under 1 hour
- Allow only TLS 1.2 and 1.3.
- Reload the web server and re-run the scan to confirm.
nginx
ssl_protocols TLSv1.2 TLSv1.3;
Apache
SSLProtocol -all +TLSv1.2 +TLSv1.3
low Certificate expires in 19 days
When it expires, browsers block the site until a new certificate is installed.
Why it matters
When the certificate expires, the site goes down for every visitor until it is renewed.
Evidence
valid_to=2026-11-17T09:12:44+00:00
How to fix Quick fix · under 1 hour
- Renew the certificate.
- Automate renewal (certbot timer, hosting auto-renew).
certbot
sudo certbot renew --dry-run # test the automatic renewal
Email security 2
medium DMARC is in monitoring mode (p=none)
p=none only collects reports. Mail that fails authentication is still delivered, so the domain is not protected against spoofing yet.
Why it matters
p=none only observes. Spoofed mail is still delivered, so customers can still receive phishing that looks like it comes from you.
Evidence
v=DMARC1; p=none; rua=mailto:dmarc@acme-store.example
How to fix Moderate · a few hours
- Check the aggregate reports for legitimate senders that fail.
- Fix them (SPF include or DKIM signing).
- Change p=none to p=quarantine, later p=reject.
DNS TXT
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
low No MTA-STS policy
Without MTA-STS, mail sent to you can be downgraded to unencrypted delivery.
Why it matters
Mail to you can be downgraded to unencrypted delivery by an attacker in the network path, exposing its contents.
Evidence
No v=STSv1 TXT record at _mta-sts.acme-store.example.
How to fix Moderate · a few hours
- Host a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt.
- Publish the _mta-sts TXT record.
- Start in testing mode, switch to enforce after checking TLS-RPT reports.
mta-sts.txt
version: STSv1 mode: testing mx: mail.example.com max_age: 604800
DNS TXT
_mta-sts.example.com. TXT "v=STSv1; id=20260101"
DNS & attack surface 3
low DNSSEC is not enabled
DNS answers for the domain are not signed.
Why it matters
Forged DNS answers can redirect visitors or mail to an attacker's server without any warning.
Evidence
No DS record for acme-store.example in the parent zone.
How to fix Quick fix · under 1 hour
- Enable DNSSEC signing at your DNS provider (often a single switch).
- Copy the DS record it shows into your registrar's control panel.
low No CAA record
The domain has no CAA record, so any certificate authority may issue certificates for it.
Why it matters
Any of the hundreds of certificate authorities may issue a certificate for your domain; CAA limits that to the ones you actually use, reducing mis-issuance risk.
Evidence
No CAA record at acme-store.example.
How to fix Quick fix · under 1 hour
- Find which CA issues your certificates (shown in the certificate details).
- Publish a CAA record naming it.
DNS CAA (Let's Encrypt)
example.com. CAA 0 issue "letsencrypt.org" example.com. CAA 0 iodef "mailto:security@example.com"
low Non-production hosts are publicly resolvable
Host names suggesting development, testing or administration resolve on the public internet.
Why it matters
Development, staging and admin systems are typically less patched and protected than production, and often contain real data - a common entry point.
Evidence
staging.acme-store.example admin.acme-store.example
How to fix Moderate · a few hours
- Put these hosts behind a VPN, SSO or an IP allowlist.
- Remove public DNS records of hosts that are no longer used.
Known vulnerabilities 2
critical PHP 7.4.3: 1 actively exploited vulnerability Needs confirmation
These vulnerabilities are listed in CISA's Known Exploited Vulnerabilities catalog: attackers are using them in real attacks right now. Version-matched, so confirm that the deployed build is affected - and if it is, treat it as an emergency.
Why it matters
Criminal groups are exploiting these vulnerabilities right now, often within days of publication and frequently to deploy ransomware. An exposed vulnerable server is likely to be found by automated attack tools.
Evidence
Disclosed version: PHP 7.4.3 CVE-2024-4577 (CVSS 9.8) - PHP-CGI OS Command Injection Vulnerability; in KEV since 2024-06-12; ransomware use: Known
How to fix Moderate · a few hours
- Confirm the installed version and whether the vulnerable feature is in use.
- Patch or upgrade immediately; if you cannot, restrict access to the service until you can.
- Look for signs of compromise: unknown accounts, new files in the web root, unusual outbound traffic.
- Re-run the scan to confirm the version is no longer affected.
Debian / Ubuntu
sudo apt update && sudo apt upgrade sudo apt install unattended-upgrades && sudo dpkg-reconfigure unattended-upgrades
RHEL / Alma / Rocky
sudo dnf upgrade --security
critical PHP 7.4.3: 37 known vulnerabilities Needs confirmation
NVD lists 37 published vulnerabilities for PHP 7.4.3 (3 critical, 14 high, 18 medium, 2 low). The most severe are listed separately below.
Why it matters
Published vulnerabilities come with public exploit details, and attackers scan for vulnerable versions automatically. Outdated server software is one of the top causes of breaches.
Evidence
Disclosed version: php 7.4.3 Matched as cpe:2.3:a:php:php:7.4.3 Highest CVSS: 9.8
How to fix Moderate · a few hours
- Confirm the installed version on the server (a distribution may have backported fixes).
- Upgrade to the latest supported release, or apply your distribution's security updates.
- Enable automatic security updates.
Debian / Ubuntu
sudo apt update && sudo apt upgrade sudo apt install unattended-upgrades && sudo dpkg-reconfigure unattended-upgrades
RHEL / Alma / Rocky
sudo dnf upgrade --security
| CVE | Severity | Description |
|---|---|---|
| CVE-2024-4577 CVSS 9.8 Exploited |
critical | In PHP versions before 8.1.29, 8.2.20 and 8.3.8, when using Apache and PHP-CGI on Windows, some characters may be interpreted as command-line options, allowing remote code execution. |
| CVE-2022-31625 CVSS 8.1 |
high | In PHP before 7.4.30, when using the PostgreSQL database extension, supplying invalid parameters to the parametrized query may lead to freeing memory that is still in use. |
Observations
What the scan saw: records, certificates, technologies and open services. Not problems by themselves, but useful to review.
info Certificate details
The X.509 certificate served on this port.
Evidence
subject=CN=acme-store.example issuer=CN=R11,O=Let's Encrypt,C=US key=RSA 2048-bit, signature=sha256
info Email authentication records
The mail-related records published for acme-store.example.
Evidence
MX: 10 mx1.mail-provider.example. SPF: v=spf1 include:_spf.mail-provider.example -all DMARC: v=DMARC1; p=none; rua=mailto:dmarc@acme-store.example DKIM selectors found: selector1 MTA-STS: none TLS-RPT: v=TLSRPTv1; rua=mailto:tls@acme-store.example
info No CMS detected
The home page did not identify WordPress, Drupal or Joomla.
info Not on checked blocklists
Neither the server addresses nor the domain appear on the blocklists checked.
Evidence
Checked: Barracuda, SpamCop, Spamhaus DBL, Spamhaus ZEN, SURBL, UCEPROTECT
info Open ports (3)
TCP ports that accepted a connection, with any banner they volunteered.
Evidence
22/tcp (ssh) — SSH-2.0-OpenSSH_8.9p1 80/tcp (http) 443/tcp (https)
info Subdomains discovered (6 live)
Host names found through Certificate Transparency logs and common-name resolution.
Evidence
www.acme-store.example mail.acme-store.example shop.acme-store.example api.acme-store.example staging.acme-store.example admin.acme-store.example 14 names appear in public certificate logs.
info Technologies detected
Software and services the home page reveals.
Evidence
PHP, Apache, jQuery, Bootstrap, Google Analytics
All checks
75 passed · 14 failed · 8 not applicable · 0 not tested
Web security
Site is served over HTTPS
HTTP redirects to HTTPS
HSTS enabled with a long lifetime
Content-Security-Policy restricts scripts
MIME sniffing disabled (X-Content-Type-Options)
Clickjacking protection (X-Frame-Options / frame-ancestors)
Referrer-Policy set
Permissions-Policy set
Cookies flagged Secure, HttpOnly and SameSite
Server software versions hidden
Cross-origin requests restricted (CORS)
security.txt published
No mixed content on HTTPS pages
Forms submit over HTTPS
CDN scripts protected with Subresource Integrity
CMS version not public (not applicable)
CMS user names not public (not applicable)
WordPress XML-RPC disabled (not applicable)
Data exposure
Directory listing disabled
Debug error pages turned off
No public CMS debug log (not applicable)
No public /.git/HEAD
No public /.env
No public /.aws/credentials
No public /wp-config.php.bak
No public /backup.sql
No public /.htpasswd
No public /actuator/env
No public /server-status
No public /phpinfo.php
No public /.DS_Store
No public /.vscode/sftp.json
No public /.git/config
No public /.env.local
No public /.env.production
No public /.ssh/id_rsa
No public /.npmrc
No public /docker-compose.yml
No public /web.config
No public /.svn/wc.db
No public /backup.zip
No public /backup.tar.gz
No public /database.sql
No public /server-info
No public /phpmyadmin/
No public /adminer.php
No public /manager/html
TLS & certificates
Certificate within its validity period
Certificate valid for 30+ more days
Certificate covers the host name
Certificate chain trusted by browsers
Certificate key at least 2048-bit
Certificate signed with SHA-256 or better
TLS 1.0 disabled
TLS 1.1 disabled
TLS 1.3 supported
Email security
SPF record published
SPF rejects unlisted senders
SPF within the 10-lookup limit
SPF avoids the deprecated ptr mechanism
DMARC record published
DMARC enforces quarantine or reject
DMARC protects subdomains
DMARC reports collected
DKIM signing key published
DKIM key at least 2048-bit
MTA-STS enforces encrypted delivery
SMTP TLS reporting enabled
Network & services
No plaintext FTP
Not on spam or malware blocklists
telnet (23) not exposed
smb (445) not exposed
mssql (1433) not exposed
cpanel (2083) not exposed
whm (2087) not exposed
mysql (3306) not exposed
rdp (3389) not exposed
postgresql (5432) not exposed
vnc (5900) not exposed
redis (6379) not exposed
elasticsearch (9200) not exposed
webmin (10000) not exposed
memcached (11211) not exposed
mongodb (27017) not exposed
DNS & attack surface
CAA record restricts certificate issuance
Zone transfers refused (AXFR)
DNSSEC enabled
Domain registration valid for 30+ days
No subdomain takeover risk
No dangling CNAME records
No public development or admin hosts
Known vulnerabilities
No WordPress plugins or themes with known vulnerabilities (not applicable)
WordPress plugins and themes maintained and up to date (not applicable)
No known CVEs in disclosed software versions
No actively exploited vulnerabilities (CISA KEV)
Software versions still receive security fixes (not applicable)
Software on the latest patch release (not applicable)
Scope & method
Target: acme-store.example Resolved addresses: 192.0.2.44 Authorized by: Verified domain acme-store.example (dns)
The scan observed the target from the public internet and did not exploit, brute-force or modify anything. Findings marked "needs confirmation" are inferred rather than observed directly - from a disclosed version number, or from an open port on a host that accepts every connection - and count half in the score. Results reflect the state at the time of the scan.