Website security posture
Simon's HTML 3.2 Test & Example Page
Last scanned 1 scan since Nov 7, 2026, 08:58 PM UTCkiwiwiki.nz/
This page shows the stored results of the latest scan. It is only recomputed when someone scans again.
Security posture
Security posture of kiwiwiki.nz: 7 checks passed, 1 warnings and 6 failed across HTTP headers, TLS, cookies, CORS, DNS and email authentication.
Public pages only show configuration that anyone can observe. Vulnerability matches, exposed files and secrets are never published; they appear only in the report of whoever ran the scan.
Configuration checks
Results of passive checks from the latest scan.
HTTPS & TLS
HTTPS
Served over HTTPS with a certificate the scanner's TLS stack accepted.
HTTP → HTTPS redirect
Plain HTTP answers with 200 without redirecting to HTTPS.
HTTP security headers
Strict-Transport-Security
Header missing.
Content-Security-Policy
No policy.
Framing protection
Neither X-Frame-Options nor CSP frame-ancestors.
X-Content-Type-Options
Header missing.
Referrer-Policy
Not set (browsers default to strict-origin-when-cross-origin).
Permissions-Policy
Not set (optional: restricts camera, microphone, geolocation…).
Cross-Origin-Opener-Policy
Not set (optional cross-window isolation).
Version disclosure
No version numbers in Server / X-Powered-By headers.
Cookies
Cookie attributes
The page set no cookies.
CORS
CORS policy
No Access-Control-Allow-Origin for a foreign origin.
Page content
Mixed content
No http:// subresources.
Form actions
13 form(s); 0 submit over HTTP.
Subresource Integrity
No third-party scripts.
Public source maps
No source map references in fetched scripts.
security.txt
No valid /.well-known/security.txt (recommended so researchers can report issues).
DNS
CAA records
No CAA record: any certificate authority may issue certificates for the domain.
DNSSEC
Answers are not DNSSEC-signed.
Email authentication
SPF record
No SPF record found.
DMARC policy
No DMARC record found.
DKIM keys
No key at common selectors. DKIM selectors cannot be listed, so this is not proof DKIM is missing.
MTA-STS
No MTA-STS record (optional: enforces TLS for inbound mail).
Detected technologies
Fingerprints from responses and page resources. They may not reflect everything the site uses.
How this was scanned
- • HTTP header, cookie, CORS & TLS checks - scanner, completed
- • Technology & version fingerprinting - scanner, completed
- • Client-side secrets, debug output & script supply chain - scanner, completed
- • DNS & email authentication - scanner, completed
Limitations
- • Passive scan: only publicly reachable responses were analysed. Content behind logins and client-side rendered routes may not be covered.
- • Version-based CVE matches rely on what the site discloses; distributions often backport fixes without changing version banners.
- • Exposed-file probes, TLS cipher analysis and template-based checks run only after domain ownership verification.
Scan your own website for vulnerabilities
Scan public websites for free - no account needed. Go Pro for GitHub repository scans, source uploads, full CVE details, Compare and the API.