Loading...
Loading...
Dies ist ein Beispiel dafür, wie ein Website-Vertrauens- & Sicherheitsanalyse-Bericht aussieht, wenn Sie einen für Ihre Website bestellen. Tatsächliche Berichte werden an Ihre Website und Ihren Geschäftskontext angepasst.
example-shop.com · Bewertungsdatum: 2026-05-14
Note
example-shop.com has a working HTTPS setup (good), but is missing two critical security headers: CSP and HSTS. These gaps increase the risk of client-side attacks and could affect customer trust. Email authentication (SPF) is properly configured, but the DMARC policy is in monitoring-only mode, meaning email spoofing is still possible. No sensitive files were found exposed. Overall trust score: 62/100 (Grade C).
Your website is served over HTTPS with a valid TLS certificate. All traffic is encrypted.
Empfehlung: Maintain HTTPS. Ensure auto-renewal of TLS certificate (current expiry: 89 days).
The CSP header is missing. Without CSP, your site is more vulnerable to cross-site scripting (XSS) and data injection attacks.
Not presentEmpfehlung: Add a Content-Security-Policy header. Start with a report-only policy, monitor violations, then enforce.
HSTS header is missing. Browsers won't know to always use HTTPS for your domain.
Not presentEmpfehlung: Add the Strict-Transport-Security header with a max-age of at least 31536000 (1 year).
DMARC record exists but policy is set to "none" (monitoring only). Emails that fail SPF/DKIM are not rejected.
v=DMARC1; p=none; rua=mailto:dmarc@example.comEmpfehlung: After confirming legitimate email sources, change policy from p=none to p=quarantine, then eventually to p=reject.
SPF record is present with a hard fail policy (-all). Unauthorized servers will be rejected.
Empfehlung: Review authorized sending services periodically to ensure the SPF record stays current.
robots.txt file found and includes a Sitemap reference. No sensitive paths exposed.
Empfehlung: No action needed. Good practice for search engines and security transparency.
No security.txt file was found at /.well-known/security.txt. Recommended by RFC 9116.
Empfehlung: Consider adding a security.txt file with a contact email for security issue reports.
No .env, .git/config, backup archives, or other sensitive files found exposed on the web server.
Empfehlung: Continue good practices: keep configuration files out of the web root.
Dies ist ein Musterbericht zu Demonstrationszwecken. Echte Bewertungen werden an Ihre Website angepasst und enthalten Geschäftskontext, priorisierte Empfehlungen und spezifische Sanierungsanleitungen. Vor jeder echten Bewertung ist eine schriftliche Genehmigung erforderlich.
Jeder Bericht enthält geschäftsorientierte Ergebnisse, praktische Anleitungen und eine Bewertung, die Sie im Laufe der Zeit verfolgen können.