Grade B — 1 to fix, 2 minor.
passive scan · the deep checks need you signed in · scanned 16h ago
This is a passive website security report for vgspartans.org, graded B (89/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 3 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site? Get the same free report for yours →
The domain vgspartans.org publishes no SPF record. SPF is the DNS record that lists which mail servers are allowed to send email as your domain. Without it, spam filters have no way to tell your real mail from a forgery, and messages you do send are more likely to land in spam.
You have a Content-Security-Policy, which is great — but it contains a wildcard source or allows 'unsafe-inline'/'unsafe-eval' in script-src. Those let injected scripts execute, which is most of what a CSP is meant to stop.
vgspartans.org publishes no CAA records. CAA tells the world which certificate authorities are allowed to issue HTTPS certificates for your domain. Without it, any CA can be persuaded to issue a cert for your domain, which widens the door to mis-issuance.
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not vgspartans.org? Scan your own site free →