Security Directory

I

IMT Mines Alès Alumni

mines-ales.org

40

IMT Mines Alès Alumni operates as a non-profit alumni association dedicated to serving graduates, students, and recruiters associated with IMT Mines Alès. The website provides comprehensive services including networking, career support, event management, and community engagement. It maintains a strong presence on social media and integrates multiple partner organizations, reflecting a well-established position within the French educational sector. The content is professionally presented in French, targeting alumni and related stakeholders. Technically, the website is built on a custom CMS platform with a technology stack including Apache, PHP, jQuery, Bootstrap, and various JavaScript libraries. While the site is mobile-optimized and SEO-friendly, performance metrics indicate slow loading times. The hosting appears to be with OVH, and the site uses several third-party services for analytics, cookie consent, and anti-bot measures. From a security perspective, the site implements several important HTTP security headers and a content security policy. However, the absence of a valid SSL certificate and lack of TLS protocol support significantly weaken its security posture. Cookies are set with secure and HttpOnly flags, and forms include anti-bot protection via hCaptcha. Privacy compliance is strong, with clear cookie and privacy policies and GDPR adherence. Overall, the site is functional and professional but requires urgent improvements in SSL/TLS configuration to enhance security and user trust. Addressing these issues will improve the security score and overall risk profile, ensuring better protection for users and data integrity.

I

IMT Nord Europe Alumni

imt-lille-douai.org

40

IMT Nord Europe Alumni is a French non-profit alumni association serving graduates and students of IMT Nord Europe. The website provides a comprehensive platform for alumni networking, career services, events, and publications. It targets alumni, students, recruiters, and partners, positioning itself as a key community hub for the institution's graduates. The site is professionally designed with consistent branding and good content relevance, supporting a medium-sized organization in the education sector. Technically, the website uses a traditional LAMP stack with Apache and PHP, enhanced by modern JavaScript libraries such as jQuery, Bootstrap, and TinyMCE. The site is mobile-optimized and includes accessibility and SEO best practices, although performance is moderate. Hosting appears to be on a standard provider with no advanced CDN or cloud infrastructure detected. From a security perspective, the site implements several important HTTP security headers and a comprehensive Content Security Policy. However, it lacks a valid SSL certificate and proper TLS configuration, which is a critical vulnerability impacting user trust and data security. Cookie consent and privacy policies are implemented, indicating good privacy compliance, but no explicit security policy or incident response information is available. Overall, the site is functional and professional but requires urgent improvements in SSL/TLS deployment and security posture to protect user data and maintain trust. Strategic enhancements in incident response and vulnerability disclosure policies would further strengthen its security maturity.

I

IMT Mines Albi-Carmaux Alumni

mines-albi.org

40

IMT Mines Albi-Carmaux Alumni operates as a non-profit alumni association serving graduates, students, and recruiters connected to the IMT Mines Albi-Carmaux engineering school in France. The website provides comprehensive services including news updates, event management, career resources, and an extensive alumni directory with nearly 40,000 registered members. The platform targets alumni and community members seeking networking and professional development opportunities. Technically, the website employs a traditional tech stack with jQuery, Bootstrap, slick carousel, and integrates hCaptcha for form security and tarteaucitron.js for cookie consent management. However, the site suffers from a critical lack of valid SSL/TLS certificates, resulting in no HTTPS support and no modern TLS protocols enabled, which significantly undermines its security posture. Despite this, the site maintains GDPR compliance through cookie consent and privacy policies, and offers a good user experience with clear navigation and responsive design. The overall risk is moderate due to security gaps, particularly the absence of HTTPS and security headers, which should be prioritized for remediation.

A

Amicale des Ingénieurs Généraux des Ponts, des Eaux et des Forêts

aigpef.org

40

The website aigpef.org represents the Amicale des Ingénieurs Généraux des Ponts, des Eaux et des Forêts, a French professional association focused on engineers from the IPEF corps. It provides member services including a directory, events, publications, and a private member area. The site targets members and alumni of this engineering corps and operates as a small non-profit entity within the government/association sector. Technically, the site uses a traditional LAMP stack with Apache, PHP, jQuery, and Bootstrap, and is likely hosted by OVH. While the site has a professional design and good content quality, it suffers from a critical security issue: the SSL certificate is invalid or missing, resulting in no HTTPS support. This severely impacts the security posture and trustworthiness of the site. Security headers and cookie consent mechanisms are well implemented, and analytics tools like Google Analytics and Hotjar are used with privacy compliance in mind. Overall, the site is functional and professional but requires urgent SSL remediation to improve security and user trust.

U

Union des Ingénieurs des Ponts, des Eaux et des Forêts

unipef.org

40

UnIPEF is a French professional association serving engineers specialized in civil engineering, water management, and forestry sectors. It offers membership services including networking, career support, events, and publications. The website is well-structured, content-rich, and targets primarily French-speaking engineering professionals. The association maintains partnerships with several related organizations and provides multiple channels for member engagement.

I

IMT Nord Europe Alumni

imt-nord-europe.org

40

IMT Nord Europe Alumni is a French non-profit alumni association serving graduates, students, and recruiters affiliated with IMT Nord Europe. The website offers a comprehensive platform for alumni networking, career services, events, and publications, supported by a large member base. Technically, the site uses a modern JavaScript stack with libraries such as jQuery, Bootstrap, and slick-carousel, and integrates security features like hCaptcha and GDPR-compliant cookie consent. The SSL configuration is valid but could be improved with HSTS and stronger DMARC policies. Overall, the site is professional and trustworthy but has room for performance and security enhancements.

S

Sodern

sodern.com

50

Sodern is a French technology company specializing in space optronics and neutron technology, operating as a subsidiary of ArianeGroup. The company holds a leading position globally and in Europe in its niche markets, providing advanced products such as star trackers, spatial cameras, and neutron analysis equipment primarily for defense, space, and mining sectors. The website reflects a professional corporate presence with comprehensive content, legal compliance pages, and active social media engagement. Technically, the site is built on WordPress with modern plugins and frameworks, but suffers from critical security shortcomings due to the absence of a valid SSL certificate and HTTPS support, which significantly impacts its security posture. Privacy compliance is well addressed with GDPR-aligned policies and consent mechanisms. Overall, the site demonstrates good business credibility and content quality but requires urgent security improvements to protect user data and enhance trust.

X

XMP-Consult

xmp-consult.org

40

XMP-Consult operates as a network of independent consultants primarily serving French-speaking business leaders and members seeking consulting services. The website provides a membership platform, events calendar, publications, and a newsletter to engage its community. The business model focuses on connecting consultants with clients and fostering professional development through events and shared resources. Technically, the site is hosted on OVH with Apache server, uses a variety of JavaScript libraries including jQuery, Bootstrap, and TinyMCE, and employs a CMS likely based on NetAssoc. While the site is content-rich and well-structured with good mobile optimization, performance is slow and SEO is basic. Security posture is weakened by the absence of a valid SSL certificate and lack of modern TLS protocols, despite good security headers and cookie consent mechanisms. Privacy compliance is strong with GDPR-aligned cookie policies and consent banners. Overall, the site is professional and trustworthy but requires urgent improvements in SSL/TLS configuration to enhance security and user trust.

M

MAIF

maif-evenements.fr

40

MAIF Evénements is a French event listing platform affiliated with the MAIF insurance group, focusing on promoting local community events across France. The website provides an interactive map and search functionality for users to find events by department and date. It leverages WordPress CMS with a variety of plugins and scripts to deliver a responsive and SEO-optimized user experience. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which significantly impacts its security posture. While privacy and cookie policies are referenced, they reside on the main MAIF domain rather than this subdomain. Social media links connect to official MAIF accounts, enhancing trust. Overall, the site is functional and professionally designed but requires urgent security improvements to protect user data and ensure compliance.

V

VRM

vrm-trauer.de

40

VRM-Trauer.de is a regional German online platform specializing in obituary and mourning announcements, serving regions such as Rhein-Main, Rheinhessen, Südhessen, and Mittelhessen. The website offers comprehensive services including obituary searches, placing ads, memorial pages, grief support, and a directory of funeral service providers. It targets individuals seeking regional mourning information and related services. The platform demonstrates a consistent brand presence and good content quality with clear navigation and mobile optimization. Technically, it employs common web technologies such as jQuery, Bootstrap, and Select2, hosted on Versatel infrastructure. However, the website critically lacks HTTPS support, exposing users to security risks. Cookie consent and privacy policies are well implemented, reflecting GDPR compliance. Overall, the site is functional but requires urgent security improvements.

J

J2 Global Canada, Inc.

smtp.com

55

SMTP.com is an enterprise-level email delivery and relay service operated by J2 Global Canada, Inc., a subsidiary of Ziff Davis. The company offers a comprehensive suite of email services including SMTP relay, transactional email, and email API solutions, targeting businesses and developers with high volume and transactional email needs. The website demonstrates a strong market position with over 20 years of industry experience and a focus on deliverability and reputation management. Technically, the site is built on WordPress with Elementor and uses a variety of marketing and analytics tools such as Visual Website Optimizer and Google Tag Manager. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which is a critical security vulnerability. Additionally, a subdomain takeover vulnerability exists on staging.smtp.com, posing a risk to brand reputation and security. Privacy and cookie policies are comprehensive and GDPR compliant, with active consent mechanisms in place. Overall, the site presents a professional business front but requires urgent security improvements to protect user data and maintain trust.

D

Deciso

opnsense.org

48

OPNsense.org is the official website for OPNsense®, an open source firewall and routing platform developed by Deciso. The platform targets enterprises, professionals, and the open source community, offering a free core product alongside a commercial Business Edition with enhanced features. The website demonstrates a mature digital presence with comprehensive content, community engagement, and commercial offerings including official hardware and training. Technically, the site is built on WordPress with modern frontend frameworks and integrates Google Analytics and custom search capabilities. However, a critical security gap exists as the site lacks a valid SSL/TLS certificate and HTTPS support, exposing users to potential risks. Privacy policies and terms of service are present and comprehensive, but cookie consent mechanisms are not implemented. Overall, the site is professional and trustworthy but requires urgent security improvements to protect visitors and maintain credibility.

H

Handwerkskammer des Saarlandes

hwk-saarland.de

40

Handwerkskammer des Saarlandes is a regional government institution dedicated to supporting the craft and trade sector in Saarland, Germany. The organization provides comprehensive services including vocational training, further education, business start-up consulting, and operational support to handcraft businesses and individuals. The website reflects a well-established entity with a strong regional presence and a focus on quality and accessibility. Technically, the site is built on WordPress with modern JavaScript frameworks like Vue.js, ensuring a responsive and user-friendly experience. Security measures such as HTTPS, HSTS, and SPF are properly implemented, though there is room for improvement in OCSP stapling and certificate transparency. Privacy compliance is robust with a clear privacy policy and cookie consent mechanism. Overall, the site demonstrates a mature digital infrastructure aligned with its public service mission.

M

Mídia de Impacto | Agência Digital Multimídia

midiadeimpacto.com.br

51

Mídia de Impacto is a Brazilian digital multimedia agency specializing in e-commerce structuring, traffic management, website development, radio and TV services, streaming audio, inbound marketing, and visual identity. The company positions itself as an experienced player in the media sector with a focus on digital transformation and multimedia solutions. Their website is built on WordPress with WooCommerce and uses modern JavaScript libraries and plugins to deliver content. However, the site lacks a valid SSL certificate, which impacts security and trust. The presence of reCAPTCHA on forms and SPF DNS records indicates some security awareness, but the absence of HTTPS and malformed DNS CAA records are significant vulnerabilities. Privacy and cookie policies are not found, which may affect compliance with GDPR and other regulations. Overall, the website is professionally designed and content-rich but requires urgent security improvements to enhance trust and compliance.

U

UCSfm

ucsfm.com.br

39

UCSfm is a regional radio station affiliated with the Universidade de Caxias do Sul, serving the Serra Gaúcha region in Brazil with music, news, and cultural content. The website is built on WordPress and uses common plugins such as Revolution Slider and Contact Form 7, indicating a standard digital infrastructure. The site actively publishes news articles and maintains community engagement through streaming links and social sharing tools. However, the lack of a valid SSL certificate and absence of HTTPS significantly weaken the security posture. The presence of a cookie consent banner and privacy policy shows some privacy awareness, but GDPR compliance is not evident. Overall, the site is functional and moderately professional but requires urgent security improvements to protect user data and enhance trust.

M

Movelsul Brasil

movelsul.com

52

Movelsul Brasil operates the largest furniture fair in Latin America, targeting retailers, importers, architects, and designers in the furniture manufacturing and retail sectors. Established in 1977 and organized by Sindmóveis Bento Gonçalves, it holds a strong market position as a key event for business networking and industry innovation. The website supports multilingual access and provides comprehensive event information, exhibitor services, and visitor resources. Technically, the site is built on WordPress with a variety of plugins for SEO, analytics, and user engagement, hosted by KingHost. While the SSL certificate is valid, some security enhancements are recommended, including enabling HSTS and DMARC records. The site employs extensive tracking and advertising tools, including Google and Facebook pixels, with GDPR cookie consent mechanisms in place but lacks a dedicated privacy policy page. Overall, the digital presence is professional and trustworthy but could improve in performance and security posture.

H

Hispasat

hispasat.com

66

Hispasat is a leading satellite telecommunications operator specializing in the distribution of audiovisual content in Spanish and Portuguese across Europe and Latin America. As a large enterprise and a subsidiary of Redeia, Hispasat offers a broad portfolio of satellite and data services including internet access, cellular backhaul, tele-education, and satellite programs. The website reflects a mature digital presence with multilingual support, modern UI frameworks, and a comprehensive content structure targeting telecommunications customers and partners. Technically, the infrastructure leverages Microsoft Azure hosting and AWS Route53 DNS, with a tech stack including jQuery, Bootstrap, and Google Tag Manager. Security posture is moderate with valid SSL certificates and SPF records but lacks advanced protections such as HSTS, DMARC, DNSSEC, and OCSP stapling. The site employs cookie consent mechanisms and analytics tools, indicating awareness of privacy compliance, though no explicit security or incident response policies are published. Overall, Hispasat demonstrates a professional and trustworthy online presence aligned with its market position.

P

Prêmio Salão Design

salaodesign.com.br

44

Prêmio Salão Design operates a Brazilian-focused design award platform that integrates designers and industries through contests, virtual catalogs, and galleries. The website is built on WordPress with a mature technical stack including SEO optimization and multiple marketing and analytics tools. However, the site lacks a valid SSL certificate, which poses a significant security risk to users. While cookie consent mechanisms are implemented, no explicit privacy policy or terms of service pages were found, indicating compliance gaps. The site maintains partnerships with multiple industry organizations and sponsors, reflecting a solid market presence in the design sector.

D

dimension2 economics & philosophy GmbH

cdr-lab.de

55

CDR Lab, operated by dimension2 economics & philosophy GmbH, is a German-based cooperative platform established in 2018 that focuses on Corporate Digital Responsibility (CDR). It serves as a participatory process for companies, academia, NGOs, and institutions to collaboratively develop knowledge, share experiences, and initiate joint CDR solutions through conferences, workshops, webinars, and research projects. The organization positions itself as a niche leader in responsible digital transformation and ethical digital business practices. The website is professionally built on WordPress with modern plugins and SEO optimization, targeting German-speaking audiences interested in digital responsibility and sustainability. Technically, the website leverages WordPress 6.6.1 with Colibri Page Builder Pro, Ultimate Member, The Events Calendar, and Forminator plugins. It is hosted on lima-city.de with multiple IPv4 and IPv6 addresses. Performance is moderate with a page load time of approximately 5 seconds and a page size of 450 KB. Mobile optimization and SEO are good, but accessibility is basic. The site lacks a valid SSL certificate and does not currently enforce HTTPS, which is a significant security concern. DNS records include valid SPF and DMARC policies, but DNSSEC and CAA are not enabled. From a security perspective, the absence of a valid SSL certificate and disabled TLS protocols expose the site to risks such as data interception and man-in-the-middle attacks. The site does not implement HSTS, OCSP stapling, or session resumption, further weakening its security posture. No explicit security policy, incident response contacts, or vulnerability disclosure mechanisms are present. The site collects personal data via a contact form but lacks visible cookie consent mechanisms, which may impact GDPR compliance despite having a comprehensive privacy policy hosted on a related domain. Overall, while the business and content aspects of CDR Lab are strong and professionally presented, the technical security posture requires urgent improvement to protect user data and enhance trust. Strategic recommendations include immediate SSL/TLS deployment, enabling modern security headers and protocols, and implementing cookie consent and vulnerability disclosure policies to align with best practices and regulatory requirements.

C

Central do Varejo

centraldovarejo.com.br

58

Central do Varejo is a Brazilian online media platform specializing in retail industry news, events, and analysis. It serves as a key content provider for retail professionals, franchising investors, and marketing and innovation enthusiasts in Brazil. The website is built on WordPress with Elementor and integrates multiple marketing and analytics tools such as Google Analytics, Facebook Pixel, and Microsoft Clarity. Despite good SEO practices and structured data implementation, the site suffers from an invalid SSL certificate and slow performance, which could impact user trust and search rankings. No explicit privacy or cookie policies were found, indicating potential compliance gaps. The platform uses Cloudflare for DNS but lacks advanced DNS security features like DNSSEC.

C

Criteo

criteo.com

69

Criteo is a leading global Commerce Media Platform provider headquartered in France, founded in 2005. The company offers a comprehensive suite of advertising and retail media solutions powered by extensive commerce data and AI technologies. Their platform connects brands, retailers, media owners, and agencies to deliver personalized and performance-driven advertising across multiple channels. Technically, the website is built on WordPress with modern frameworks and integrates various analytics and marketing tools such as Google Tag Manager, New Relic, Dreamdata, and OneTrust for privacy compliance. Security measures include a valid SSL certificate, HSTS enabled, and no detected vulnerabilities, although improvements in DNSSEC and CAA records are recommended. The company maintains a strong privacy and cookie policy presence with GDPR compliance and provides multiple contact points via forms. Overall, Criteo demonstrates a mature digital infrastructure, strong security posture, and a high level of professionalism and trustworthiness in its online presence.

B

Bling - Sistema de gestão online

bling.com.br

67

Bling is a prominent Brazilian SaaS ERP platform offering comprehensive business management solutions including sales, inventory, logistics, finance, and automation. It serves a large user base of over 300,000 daily users, targeting entrepreneurs, SMEs, e-commerce, physical stores, service providers, and small industries. The platform integrates with over 250 marketplaces and sales channels, providing automated invoicing and financial management with a digital account. Technically, the website is built on WordPress with modern optimization plugins like WP Rocket and uses various JavaScript libraries for UI and analytics. Security posture is solid with a valid SSL certificate and HSTS enabled, but lacks modern TLS protocol support and DNS security enhancements. Privacy and terms policies are present but cookie consent mechanisms are absent. Overall, the site demonstrates good digital maturity and strong market positioning in Brazil's ERP sector.

N

Nicols Yachts

nicolsyacht.com

71

Nicols Yachts is a French manufacturer specializing in the construction and sale of riverboats and habitable barges, serving both private individuals and professional clients. Established in 1986, the company has a strong market position in the transportation sector with a comprehensive business model that includes boat construction, sales, rental base management, and cruise commercialization. The website reflects a mature digital presence with multilingual support and e-commerce capabilities. Technically, the site is built on WordPress with Divi and WooCommerce, hosted on OVH, and optimized for performance and SEO. Security posture is solid with valid SSL certificates and HSTS enabled, but lacks modern TLS protocol support and explicit security policies. Privacy and cookie policies are well implemented and GDPR compliant. Overall, the company demonstrates a professional and trustworthy online presence with room for security enhancements.

L

Law Offices of Spar & Bernstein

sparbernstein.com

61

The Law Offices of Spar & Bernstein is a well-established legal firm specializing in immigration and personal injury law, serving clients primarily in New York City and Hartford, Connecticut. With over 60 years of experience and a strong track record of more than 100,000 cases successfully resolved, the firm positions itself as a trusted expert in its field. Their services cater to both individuals and businesses, offering tailored immigration solutions and personal injury representation. The website reflects a professional and consistent brand image, supported by client testimonials and press features that enhance trust and credibility. Technically, the site is built on WordPress with modern plugins such as Gravity Forms and uses Cloudflare for hosting and CDN services, ensuring fast performance and good SEO optimization. However, the SSL configuration lacks support for modern TLS protocols, and security headers could be improved by enabling HSTS and other best practices. The firm actively engages users through multiple social media channels and uses Google Tag Manager for analytics and marketing, though it lacks a visible cookie consent mechanism. Overall, the security posture is moderate with room for enhancements in compliance and incident response transparency.

C

CasinoMentor

casinomentor.com

57

CasinoMentor is a reputable online platform specializing in providing comprehensive and trustworthy reviews, ratings, and guides for online casinos and gambling sites. Positioned as a trusted intermediary, it offers detailed expert and user-generated content to help players make informed decisions. The platform targets online gamblers seeking reliable information on casino games, bonuses, and responsible gambling practices. Technically, the website employs a modern tech stack including PHP, Cloudflare for hosting and security, and various JavaScript libraries for enhanced user experience and analytics. Security measures are robust with strong SSL configuration and security headers, although some improvements in TLS protocol support and DNS CAA records are recommended. Overall, CasinoMentor demonstrates a mature digital presence with good performance, mobile optimization, and SEO practices, supporting its market position as a leading casino review site.

S

SalesHood

saleshood.com

74

The website demonstrates a generally stable network and email security posture, with no critical vulnerabilities identified. However, significant gaps exist in compliance with GDPR and NIS2 regulations, reflected by low scores in these areas and several high-severity issues. The absence of essential documentation such as cookie policies, consent mechanisms, security frameworks, and incident response procedures exposes the business to regulatory fines and reputational damage. Medium-level issues like expiring SSL certificates, mixed content, and missing security headers further increase the risk of data breaches and undermine user trust. While foundational network security is strong, the lack of proactive governance and transparency measures hinders overall security maturity. Addressing these shortcomings is critical to ensuring regulatory compliance, safeguarding customer data, and maintaining business continuity. Immediate focus on policy development and compliance will mitigate liability and enhance stakeholder confidence.

P

PetSure (Australia) Pty Ltd

petsure.com.au

66

The website security assessment reveals a concerning overall security posture, with no critical issues but multiple high and medium severity vulnerabilities primarily related to security headers, GDPR compliance, and NIS2 regulatory requirements. Key gaps include missing fundamental HTTP security headers, absence of essential GDPR cookie policies and consent mechanisms, and a lack of formalized information security, incident response, and business continuity frameworks. SSL/TLS configurations show weaknesses with expiring certificates and weak key lengths, raising risks of data interception. While email and network security measures are strong, DNS security can be improved. These vulnerabilities increase the risk of data breaches, regulatory fines, and reputational damage, highlighting an urgent need for remediation to protect business assets and maintain customer trust. Addressing these issues will also enhance compliance with evolving cybersecurity regulations such as NIS2 and GDPR.

O

Ooshman

ooshman.au

59

The website demonstrates significant security gaps, particularly in foundational security headers, privacy compliance, and information security governance, resulting in a poor overall security posture. While network security and email security score relatively well, critical vulnerabilities such as missing Strict-Transport-Security and Content-Security-Policy headers expose the site to data interception and cross-site scripting attacks. The absence of GDPR compliance elements like privacy and cookie policies presents legal and reputational risks. Additionally, missing NIS2-related documentation and incident response procedures indicate a lack of preparedness for cyber incidents, increasing operational risk. Weak SSL key lengths and impending certificate expiration further undermine secure communications. Addressing these high and medium priority issues is essential to protect customer data, maintain regulatory compliance, and safeguard business continuity. Immediate remediation will reduce potential breach impact, enhance customer trust, and align with industry standards.

S

Seismic

seismic.com

75

The website demonstrates a generally solid security foundation with no critical vulnerabilities detected, and strong performance in email security, SSL/TLS, DNS health, and network security. However, significant gaps exist in governance and compliance areas, notably GDPR and NIS2 regulations, with multiple high-severity issues such as missing cookie policies, lack of incident response procedures, and absence of security framework documentation. These deficiencies expose the business to regulatory risks, potential legal penalties, and reputational damage. Security headers are not fully optimized, leaving the site vulnerable to clickjacking and some cross-site scripting risks. While SSL/TLS configurations are largely robust, upcoming certificate expiry and incomplete HSTS settings require attention to maintain trust and secure communications. Overall, the organization should prioritize establishing comprehensive security policies and compliance measures to mitigate operational and regulatory risks effectively.

M

MindMaze

mindmaze.com

95

The website demonstrates a generally strong security posture with no critical or high severity issues detected. Core protections such as SSL/TLS and network security are fully implemented and scored at 100, ensuring secure data transmission and robust infrastructure defenses. However, there are medium-level concerns related to missing or incomplete security headers, lack of DNSSEC implementation, and non-compliance with GDPR and NIS2 regulatory frameworks, which could expose the business to data protection risks and regulatory penalties. Low-level issues like complex SPF records and missing CAA records indicate areas for improvement in email authentication and certificate management. Addressing these medium and low issues will enhance the website’s resilience against threats, improve compliance, and reduce potential reputational and financial risks. Overall, the business is in a strong position but should prioritize closing regulatory and DNS security gaps to maintain trust and compliance. The proactive remediation of these findings will support long-term security and regulatory adherence.

V

Volcanic

volcanic.co.uk

76

The website demonstrates a generally strong technical security foundation with perfect SSL/TLS and network security scores, and good email and DNS configurations. However, significant shortcomings exist in governance and compliance areas, particularly regarding NIS2 and GDPR requirements, which expose the business to regulatory risks and potential operational disruptions. The absence of critical security policies, incident response plans, and clear security contact information severely undermines the organization's ability to manage security incidents effectively. Additionally, missing security headers and weak email authentication configurations increase vulnerability to attacks such as cross-site scripting and email spoofing. The lack of a cookie consent banner and potentially non-compliant privacy policies also risk non-compliance with GDPR, potentially resulting in legal penalties and reputational damage. Overall, while technical controls are mostly robust, governance and compliance gaps present the most urgent business risks. Addressing these will improve resilience, regulatory compliance, and customer trust.

T

TB Events

tbevents.nl

38

The website exhibits a severely deficient security posture with multiple critical vulnerabilities that expose it to significant risks, including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is the most critical flaw, leaving all data transmissions unprotected and violating EU GDPR and NIS2 regulations. Key security headers are missing, increasing the risk of clickjacking, cross-site scripting, and content injection attacks. The lack of privacy policies and cookie consent mechanisms further exposes the business to legal and compliance penalties under GDPR. Critical gaps in information security frameworks, incident response, and business continuity planning indicate immature security governance. Email security mechanisms like DMARC and DKIM are partially implemented but need enforcement and reporting improvements. DNS security is moderate but can be enhanced by enabling DNSSEC and configuring CAA records. Overall, urgent remediation of encryption, privacy compliance, and security policy documentation is essential to safeguard business operations and customer trust.

L

Lorenza Von Stein Luxury Real Estate

lorenzavonstein.com

42

The website's security posture is currently weak and exposes significant risks to both business operations and customer trust. Critical vulnerabilities include the absence of HTTPS encryption, lack of essential email authentication, and missing critical security headers, which collectively leave the site highly susceptible to data interception, phishing, and content injection attacks. Additionally, the absence of GDPR compliance elements such as privacy and cookie policies, along with no cookie consent mechanism, exposes the business to regulatory penalties and reputational damage. The lack of documented information security policies, incident response, and business continuity plans indicates unpreparedness for managing security incidents effectively. While network security and DNS health show relatively better scores, the overall security framework is insufficient for protecting sensitive customer data and ensuring legal compliance. Immediate remediation is necessary to safeguard business continuity, customer trust, and comply with legal requirements. Without urgent action, the business faces increased risks of data breaches, regulatory fines, and operational disruptions.

H

Hazera

hazera.com

50

The website's overall security posture is currently at significant risk, primarily due to the complete lack of HTTPS encryption, which is critical for protecting data in transit and maintaining user trust. Multiple critical and high-severity issues indicate gaps in compliance with GDPR and NIS2 regulations, including missing privacy and cookie policies, absence of a cookie consent banner, and lack of security documentation and incident response procedures. While email security and network security show strong scores, foundational web security controls such as Content-Security-Policy headers and security frameworks are missing or weak. The absence of HTTPS not only affects security but also business credibility, search engine rankings, and regulatory compliance. Additionally, DNS security enhancements like DNSSEC are not enabled, increasing exposure to DNS-based attacks. The lack of clear privacy policies and consent mechanisms also poses legal and reputational risks. Immediate remediation is essential to safeguard customer data, ensure compliance, and protect the business from cyber threats and regulatory penalties.

M

MTN Bénin

mtn.bj

54

The website exhibits a concerning overall security posture with several critical and high-risk vulnerabilities that expose the business to significant legal, reputational, and operational risks. The absence of HTTPS encryption is a critical flaw, undermining data confidentiality and integrity for all website visitors and users. The lack of foundational GDPR compliance elements, such as a privacy policy and cookie consent banner, further exposes the business to potential regulatory penalties and customer trust erosion. Additionally, the missing security frameworks and incident response plans highlight insufficient readiness to detect and mitigate cyber threats or respond effectively to security incidents. While email and network security postures are strong, fundamental gaps in web security headers and DNS configurations must be addressed. Immediate remediation is needed to protect customer data, ensure regulatory compliance, and safeguard business continuity. Without these improvements, the organization remains vulnerable to data breaches, legal actions, and reputational damage.

G

GrowUp Consulting

growup-hr.com

44

The website demonstrates significant security deficiencies, particularly a complete lack of HTTPS encryption, which poses critical risks to data confidentiality and user trust. Missing essential security headers such as Strict-Transport-Security, X-Frame-Options, and Content-Security-Policy increase vulnerability to common web attacks including clickjacking and cross-site scripting. The absence of a privacy policy, cookie policy, and consent mechanisms exposes the business to regulatory non-compliance and potential legal penalties under GDPR. Furthermore, critical gaps in security governance, including missing information security frameworks, incident response procedures, and security policy documentation, indicate immature cybersecurity management. While email security and network security posture are strong, the overall security posture is weak, making the business susceptible to data breaches, reputational damage, and compliance violations. Immediate remediation is necessary to protect customer data, maintain regulatory compliance, and safeguard business continuity. Prioritizing HTTPS implementation and establishing a comprehensive security and privacy framework will significantly enhance risk mitigation. DNS security and some network controls are adequate but insufficient to compensate for the critical issues identified.

A

AFIM S.A.M.

afim.mc

37

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is a fundamental flaw, severely undermining confidentiality and trust. Missing key security headers such as Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options further increase vulnerability to common web attacks like clickjacking, cross-site scripting, and data interception. Additionally, the lack of GDPR compliance elements such as privacy policies and cookie consent mechanisms could lead to legal penalties and customer trust erosion. The absence of an information security framework, incident response plans, and vulnerability disclosure policies highlights poor organizational security maturity. Email security is also lacking due to missing DMARC and DKIM records, increasing phishing and spoofing risks. While network security and DNS health show relative strength, critical gaps overshadow these positives. Immediate remediation is essential to protect business assets and customer data effectively.

C

CHPG

chpg.mc

56

The website's overall security posture reveals significant gaps, particularly in foundational security headers, GDPR compliance, and information security management aligned with NIS2 requirements. While there are no critical vulnerabilities, the presence of multiple high and medium issues indicates increased risk exposure to data breaches, regulatory penalties, and reputational damage. Key weaknesses include missing essential HTTP security headers, lack of privacy and cookie policies, insufficient incident response and security documentation, and weak SSL/TLS configurations. Positive aspects include strong network security and relatively good DNS health. Immediate remediation is necessary to reduce the risk of cyber attacks, ensure regulatory compliance, and protect customer trust. Without addressing these issues, the business may face legal consequences and operational disruptions. Strengthening email security and enabling DNSSEC will further improve resilience against phishing and domain spoofing threats.

M

Marine Resources

marineresources.co.uk

78

The website marineresources.co.uk demonstrates a generally strong technical security posture in network, SSL/TLS, and email security; however, it lacks crucial governance and compliance elements, especially related to GDPR and the NIS2 directive. The absence of fundamental security policies, incident response capabilities, and appropriate headers exposes the business to regulatory risks and potential exploitation. Addressing these gaps is critical to reduce legal liability and protect brand reputation.

M

My Marketing Xperience

mymarketingxperience.com

60

The website mymarketingxperience.com currently exhibits a weak security posture with significant gaps in web security headers, GDPR compliance, and organizational security policies. Although network security and email security show relative strengths, the absence of critical privacy policies and security frameworks exposes the business to regulatory, reputational, and operational risks.

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. Key vulnerabilities such as the absence of HTTPS encryption and essential security headers leave user data unprotected during transmission and increase susceptibility to common web attacks like clickjacking and cross-site scripting. The lack of GDPR compliance elements—such as a privacy policy and cookie consent mechanisms—further exposes the organization to potential legal penalties and customer trust erosion. Additionally, no formal information security framework, incident response, or business continuity plans are in place, which hinders the organization's ability to detect, respond to, and recover from security incidents effectively. While email security and network security show relative strength, critical gaps in SSL/TLS configuration and NIS2 compliance pose immediate threats. Without urgent remediation, these vulnerabilities could lead to costly breaches and regulatory fines. Immediate corrective actions are necessary to secure the website, protect customer data, and ensure compliance with relevant regulations.

The website https://codeinwp.com currently exhibits significant security deficiencies, particularly in areas of web security headers, GDPR compliance, and organizational security policies, resulting in a high-risk profile despite no critical technical vulnerabilities found. While network infrastructure and email security are relatively strong, the absence of fundamental security controls and compliance measures exposes the business to data breaches, regulatory penalties, and reputational damage.

The website https://www.e-radio.lv/ currently exhibits a poor security posture with critical gaps in fundamental web security headers, GDPR compliance, and incident response preparedness. These deficiencies expose the business to legal risks, data breaches, and reputational damage, especially given its EU jurisdiction. Immediate remediation is essential to protect customer trust and ensure regulatory compliance.

The website https://equipolymers.com exhibits significant security and compliance gaps, particularly in GDPR adherence and information security governance, resulting in a high-risk posture despite no critical vulnerabilities detected. Key business risks include potential regulatory fines, reputational damage, and exposure to cyber incidents due to missing security policies and controls. Immediate remediation is necessary to strengthen trust, legal compliance, and resilience against cyber threats.