Grade B — 1 to fix, 5 minor.
passive scan · the deep checks need you signed in · scanned 3h ago
This is a passive website security report for it-som.net, graded B (83/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 6 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site? Get the same free report for yours →
There's no Content-Security-Policy header. A CSP is the single most effective defense against cross-site scripting (XSS): it tells the browser which sources of scripts, styles, and other content are allowed, so an injected <script> from a compromised dependency or a reflected input simply won't run.
Your responses advertise the exact software you run (X-Powered-By: Next.js). It's not a hole by itself, but it hands attackers a shortcut: they can look up known vulnerabilities for that precise version instead of probing blindly.
The DMARC record on it-som.net uses p=none, which only reports spoofing — it doesn't stop it. Forged mail claiming to be from your domain is still delivered.
it-som.net is not protected by DNSSEC. DNSSEC signs your DNS records so resolvers can detect a forged answer — without it, an attacker who can poison DNS could point your domain at their own server without touching anything you control.
it-som.net publishes no CAA records. CAA tells the world which certificate authorities are allowed to issue HTTPS certificates for your domain. Without it, any CA can be persuaded to issue a cert for your domain, which widens the door to mis-issuance.
These cookies are set without HttpOnly: som_locale. Any script on the page — including one injected through an XSS bug or a compromised third-party library — can read them. Session and auth cookies should never be readable by JavaScript.
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not it-som.net? Scan your own site free →