Grade C — 4 to fix, 3 minor.
passive scan · the deep checks need you signed in · scanned 12h ago
This is a passive website security report for agentloop.tools, graded C (66/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 7 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site?
There's no Content-Security-Policy header. A CSP is the single most effective defense against cross-site scripting (XSS): it tells the browser which sources of scripts, styles, and other content are allowed, so an injected <script> from a compromised dependency or a reflected input simply won't run.
Nothing stops your site from being embedded in an <iframe> on another domain. An attacker can overlay an invisible frame of your app on their page and trick a logged-in user into clicking buttons they can't see — a clickjacking attack.
Without `X-Content-Type-Options: nosniff`, browsers may guess ("sniff") the type of a response and, for example, run an uploaded file as JavaScript. It's a one-line header that closes a whole class of content-type confusion bugs.
Your responses advertise the exact software you run (X-Powered-By: Next.js). It's not a hole by itself, but it hands attackers a shortcut: they can look up known vulnerabilities for that precise version instead of probing blindly.
The domain agentloop.tools publishes no SPF record. SPF is the DNS record that lists which mail servers are allowed to send email as your domain. Without it, spam filters have no way to tell your real mail from a forgery, and messages you do send are more likely to land in spam.
The domain agentloop.tools publishes no DMARC record. DMARC is what tells receiving mail servers to reject or quarantine messages that fail your SPF/DKIM checks. Without it, an attacker can send phishing emails with a "From:" address at your domain and inboxes have no signal to distrust them — a favourite trick for invoice fraud and credential phishing.
agentloop.tools is not protected by DNSSEC. DNSSEC signs your DNS records so resolvers can detect a forged answer — without it, an attacker who can poison DNS could point your domain at their own server without touching anything you control.
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not agentloop.tools? Scan your own site free →