Sample report

See what to fix next.

A useful report connects an observation to its consequence, the person who can act, and a way to check the result.

Fictional example for example.test. These three checks illustrate the report; no website was scanned and no customer data is shown.

Start here

Items needing attention: 1 · Unassessed checks: 1

In this example, HTTPS works, but the response does not tell browsers to remember it. Review HSTS with the hosting provider.

A reassuring observation is not a security certificate. Account protection remains unknown because a public website check cannot inspect it.

Remember HTTPS with HSTSNeeds attention

An expected header or directive was absent or did not meet this check.

Priority: Low · High confidence

Practical consequence: Without HSTS, a browser may try HTTP on a later visit.
Who can act: Hosting provider
Action and recovery precautions: After validating reliable HTTPS, enable HSTS with a short max-age. Review every affected hostname before considering includeSubDomains or preload. Cached policies can outlive a rollback.
Verification criterion: Recheck for a positive max-age; review browser behavior separately.
Limits: A present header does not prove the strength of the complete policy.

HTTPS certificateObserved

The certificate validated for the observed connection.

Priority: Information · High confidence

Practical consequence: A rejected certificate can prevent visitors from establishing a trusted connection.
Who can act: Hosting provider or website administrator
Action and recovery precautions: Check the hostname, certificate chain and validity with your host. Keep a working configuration available for rollback; do not ask visitors to bypass warnings.
Verification criterion: A new connection to this hostname validates the certificate successfully.
Limits: This checks one connection. It does not audit every TLS setting or certify the website.

Account multifactor authenticationUnassessed

Account protection requires separately authorized evidence.

Priority: Information · Insufficient evidence

Practical consequence: Public pages do not establish how administrator accounts are protected.
Who can act: Account owner or identity administrator
Action and recovery precautions: Review account protections with the provider. Before changing authentication, verify recovery access and securely retain recovery methods to avoid lockout.
Verification criterion: An authorized account review demonstrates MFA and tests the agreed recovery procedure.
Limits: No login was attempted. This public baseline cannot verify MFA.

This fictional HTTPS response has a valid certificate and HTML content, but no Strict-Transport-Security header.

https://example.test/
HTTP 200
content-type: text/html

Real reports retain dated observations and their integrity references. They describe the checked hostname and response, not every page or account.

Choose a priority and review its evidence and recovery precautions with your technical contact.
Make the change in your own infrastructure after reviewing its effect. The service does not apply fixes automatically.
Recheck the selected finding and compare the new observation with the previous report.