Grade B — 2 to fix, 2 minor.
passive scan · the deep checks need you signed in · scanned 13h ago
This is a passive website security report for ai.engage.agency, graded B (82/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 4 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site? Get the same free report for yours →
There's no Content-Security-Policy header. A CSP is the single most effective defense against cross-site scripting (XSS): it tells the browser which sources of scripts, styles, and other content are allowed, so an injected <script> from a compromised dependency or a reflected input simply won't run.
Nothing stops your site from being embedded in an <iframe> on another domain. An attacker can overlay an invisible frame of your app on their page and trick a logged-in user into clicking buttons they can't see — a clickjacking attack.
The DMARC record on engage.agency uses p=none, which only reports spoofing — it doesn't stop it. Forged mail claiming to be from your domain is still delivered.
engage.agency publishes no CAA records. CAA tells the world which certificate authorities are allowed to issue HTTPS certificates for your domain. Without it, any CA can be persuaded to issue a cert for your domain, which widens the door to mis-issuance.
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not ai.engage.agency? Scan your own site free →