Grade B — 2 to fix, 3 minor.
passive scan · the deep checks need you signed in · scanned 5h ago
This is a passive website security report for docs.firecrawl.dev, graded B (80/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 5 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site?
Public Certificate Transparency logs reveal internal-looking hostnames under firecrawl.dev: api.staging.firecrawl.dev, mcp.staging.firecrawl.dev, work.staging.firecrawl.dev. Names like staging, dev, and admin are found by attackers the same way we found them here — from public logs, no scanning required — and these hosts are often left less protected than production.
Visiting http://docs.firecrawl.dev (no "s") serves the site over an unencrypted connection instead of redirecting to HTTPS. Anyone typing the bare domain, or following an old http:// link, gets an unencrypted page where their traffic can be read or modified in transit.
Without `X-Content-Type-Options: nosniff`, browsers may guess ("sniff") the type of a response and, for example, run an uploaded file as JavaScript. It's a one-line header that closes a whole class of content-type confusion bugs.
firecrawl.dev is not protected by DNSSEC. DNSSEC signs your DNS records so resolvers can detect a forged answer — without it, an attacker who can poison DNS could point your domain at their own server without touching anything you control.
firecrawl.dev publishes no CAA records. CAA tells the world which certificate authorities are allowed to issue HTTPS certificates for your domain. Without it, any CA can be persuaded to issue a cert for your domain, which widens the door to mis-issuance.
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not docs.firecrawl.dev? Scan your own site free →