Sample report: lordevo.com
Sample report: lordevo.com
A real free Safe Scan of our own site, made by the same code that scans yours. A Deep / Active Scan report adds multi-URL nuclei findings, TLS/JS-secret/CORS modules, OWASP mapping and fix-first remediation, and arrives by email as PDF + HTML.
Scanned 24 Oct 2026, 11:39 UTC. GET/HEAD and DNS only. No exploitation, fuzzing or load testing.
Recent threats checked
eMudhra intermediate CA weak keys (Oct 2026)
Eight eMudhra Global TLS intermediate CA private keys were recoverable (weak entropy from a April 2025 key ceremony). Browsers/root programs blocked them; eMudhra revoked the intermediates. No certificates had been issued from them, but clients that do not consume revocation needed trust-store updates.
Checked: PASS
PHP2Shell — CVE-2026-109618 / CVE-2026-109619
Critical unauthenticated RCE in PHP web runtimes. Version not advertised on this host; deep scan can probe further with authorization.
Checked: NOT_ADVERTISED
Transport
HTTPS used
The final URL uses HTTPS.
TLS
Certificate validity
Certificate valid until Jan 20 09:59:40 2027 GMT (87 days left). Subject: lordevo.com.
TLS protocol
Negotiated TLSv1.3 with cipher TLS_AES_256_GCM_SHA384.
eMudhra compromised intermediate (Oct 2026)
Certificate chain does not include the eight compromised eMudhra intermediate SPKIs published Oct 2026.
Security headers
HSTS
HSTS: max-age=15552000
Content-Security-Policy
Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self' 'sha256-mrJ7xB7cbF2V62o0CMyWGr8yVpQTgkvRAUTYRusmRsM='; form-action 'self' https://
X-Frame-Options
X-Frame-Options: DENY
X-Content-Type-Options
X-Content-Type-Options: nosniff
Referrer-Policy
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy
Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
Cookies
Set-Cookie flags
No Set-Cookie headers on the home page response.
Disclosure
Server header
Server: cloudflare
How to fix: Avoid advertising exact software versions in the Server header.
X-Powered-By
No X-Powered-By header.
Known CVE surface
PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PHP version was not advertised in headers. Cannot confirm patch level from a passive check.
How to fix: If you run PHP, ensure you are on 8.2.35+ / 8.3.36+ / 8.4.27+ / 8.5.12+. Order a Deep Scan for active checks.
Exposure
security.txt
No /.well-known/security.txt found.
How to fix: Consider publishing a security.txt contact for researchers.
Open directory listing (home)
Home page does not look like a directory index.
Common sensitive paths
No obviously sensitive common files responded with interesting content (passive GET sample).
DNS / email
SPF
v=spf1 include:spf.privateemail.com ~all
DMARC
v=DMARC1; p=quarantine; adkim=r; aspf=r; pct=100
DKIM
Found selector "default".
MX records
10 mx2.privateemail.com, 10 mx1.privateemail.com
Check your own site
The Safe Scan is free. The Deep / Active Scan is US$45 one-off after domain verification; Security Care is US$35 a month.