toolport.app

Your site is served over HTTPS but doesn't send a Strict-Transport-Security header. Without it, the first visit (or a link typed as http://) can be intercepted and downgraded to plain HTTP before the redirect happens — a foothold for man-in-the-middle attacks on public Wi-Fi.

There's no Content-Security-Policy header. A CSP is the single most effective defense against cross-site scripting (XSS): it tells the browser which sources of scripts, styles, and other content are allowed, so an injected <script> from a compromised dependency or a reflected input simply won't run.

Visiting http://toolport.app (no "s") serves the site over an unencrypted connection instead of redirecting to HTTPS. Anyone typing the bare domain, or following an old http:// link, gets an unencrypted page where their traffic can be read or modified in transit.

The DMARC record on toolport.app uses p=none, which only reports spoofing — it doesn't stop it. Forged mail claiming to be from your domain is still delivered.

toolport.app is not protected by DNSSEC. DNSSEC signs your DNS records so resolvers can detect a forged answer — without it, an attacker who can poison DNS could point your domain at their own server without touching anything you control.

toolport.app publishes no CAA records. CAA tells the world which certificate authorities are allowed to issue HTTPS certificates for your domain. Without it, any CA can be persuaded to issue a cert for your domain, which widens the door to mis-issuance.