Grade C — 5 to fix, 2 minor.
passive scan · the deep checks need you signed in · scanned 61d ago
This is a passive website security report for acmedemo.dev, graded C (61/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 7 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site? Get the same free report for yours →
acmedemo.dev publishes no DMARC record. Without it, anyone can send email that appears to come from your domain, and inboxes have no signal to distrust it — a favourite trick for invoice fraud and credential phishing.
The domain publishes no SPF record listing which mail servers may send as your domain, so spam filters can't tell your real mail from a forgery.
The HTTPS certificate expires soon. If it isn't renewed in time, every visitor will hit a full-page browser security warning.
Public Certificate Transparency logs reveal internal-looking hostnames under this domain: staging, dev, and admin. Attackers find these the same way we did — from public logs, no scanning required.
Served over HTTPS but without a Strict-Transport-Security header, so the very first visit can be downgraded to plain HTTP before the redirect happens.
The session cookie is set without HttpOnly, so any script on the page — including one injected through an XSS bug — can read it.
The domain is not protected by DNSSEC, so a resolver can't detect a forged DNS answer pointing your domain elsewhere.
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not acmedemo.dev? Scan your own site free →