Grade C — 4 to fix, 3 minor.
passive scan · the deep checks need you signed in · scanned 7h ago
This is a passive website security report for www.ift.org.mx, graded C (66/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 7 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site?
Your site is served over HTTPS but doesn't send a Strict-Transport-Security header. Without it, the first visit (or a link typed as http://) can be intercepted and downgraded to plain HTTP before the redirect happens — a foothold for man-in-the-middle attacks on public Wi-Fi.
There's no Content-Security-Policy header. A CSP is the single most effective defense against cross-site scripting (XSS): it tells the browser which sources of scripts, styles, and other content are allowed, so an injected <script> from a compromised dependency or a reflected input simply won't run.
The domain org.mx publishes no DMARC record. DMARC is what tells receiving mail servers to reject or quarantine messages that fail your SPF/DKIM checks. Without it, an attacker can send phishing emails with a "From:" address at your domain and inboxes have no signal to distrust them — a favourite trick for invoice fraud and credential phishing.
These cookies are set without the Secure flag: __uzma, __uzmb, __uzme, __uzmc, __uzmd. That means the browser will also send them over plain HTTP, where anyone on the same network can read them — including session cookies, which is enough to hijack a logged-in account.
These cookies are set without HttpOnly: HttpOnly. Any script on the page — including one injected through an XSS bug or a compromised third-party library — can read them. Session and auth cookies should never be readable by JavaScript.
These cookies don't set SameSite: HttpOnly, rdwr_s_1d89ce60618d7fd5ef630f09db0234ce. SameSite limits when the browser attaches a cookie to cross-site requests, which is a key defence against CSRF (a malicious site making authenticated requests as your user).
org.mx publishes no CAA records. CAA tells the world which certificate authorities are allowed to issue HTTPS certificates for your domain. Without it, any CA can be persuaded to issue a cert for your domain, which widens the door to mis-issuance.
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not www.ift.org.mx? Scan your own site free →