Security Directory

O

on-geo GmbH

lora.de

40

on-geo GmbH operates a suite of geospatial data service portals including LORA and Geoport, targeting professional users in real estate and related sectors primarily in Germany. The website serves as a secure login gateway for multiple branded services, providing access to geospatial data, consulting, and training. The technical infrastructure is based on Microsoft technologies with ADFS for authentication, delivering a fast and functional user experience with basic mobile optimization. Security posture is strong with HTTPS, modern TLS protocols, and multiple security headers, though improvements are recommended in HSTS configuration and email domain security. Privacy compliance is partial with a privacy policy present but lacking cookie consent mechanisms. Overall, the site demonstrates good business credibility and technical maturity with room for enhancements in privacy and security best practices.

L

Lagutogel

rinconolon.com

40

Lagutogel operates as an online platform providing live Hong Kong lottery results and related data, targeting Indonesian lottery players and enthusiasts. The website positions itself as a trusted source for accurate and timely lottery information, supplemented by affiliate links for registration and login to gambling services. Technically, the site leverages AMP technology for optimized mobile performance and is hosted behind Cloudflare, ensuring basic content delivery and security. However, the SSL certificate validity dates appear unusual, and no advanced security headers or email authentication mechanisms like DMARC are implemented. Privacy compliance is minimal, with no visible privacy or cookie policies, which may pose regulatory risks. Overall, the site delivers relevant content with moderate technical maturity but lacks comprehensive security and privacy safeguards.

I

iF Design

ifdesign.com

71

iF Design is a globally recognized organization that hosts the prestigious iF DESIGN AWARD, established in 1953. The company operates a comprehensive digital platform showcasing award winners, design trends, and community engagement for designers, architects, and companies worldwide. Their market position is strong within the design industry, offering key services such as design competitions, trend reports, and networking opportunities. Technically, the website is built on modern React and Gatsby frameworks, hosted on Microsoft Azure, with a valid SSL certificate and standard security configurations. However, performance is somewhat slow, and security headers could be enhanced. Privacy compliance is well addressed with clear policies and consent mechanisms. Overall, the site demonstrates a professional and trustworthy presence with moderate tracking and marketing tools integrated.

P

Página inacessível

apprbs.com.br

30

The website apprbs.com.br currently serves a minimal 'Página inacessível' (Page inaccessible) message with no accessible business content or user interaction features. The DNS configuration shows hosting on Google Cloud infrastructure and email services via Google Workspace with SPF records including Elastic Email. However, the site lacks a valid SSL certificate and does not support HTTPS, representing a critical security vulnerability. No privacy, cookie, or terms of service policies are present, and no contact information or forms are available, indicating the site is either down, under maintenance, or improperly configured. From a technical perspective, the site uses basic HTML5 and CSS with JSON-LD structured data indicating the domain name but no further business details. Performance is moderate but limited by minimal content. SEO is poor due to a malformed robots meta tag set to noindex and lack of metadata. Accessibility and mobile optimization are basic at best. Security posture is weak with no HTTPS, no security headers, no HSTS, and a DMARC policy set to none, exposing the domain to email spoofing risks. No WAF or security challenge was detected, but the site is effectively inaccessible to users. Overall, the site scores very low on content quality, technical implementation, security, privacy compliance, and business credibility. Strategic recommendations include immediate installation of a valid SSL certificate, enabling HTTPS, improving security headers and policies, publishing privacy and cookie policies, and restoring accessible business content to improve trust and compliance.

C

canadianlawyer.ca

canadianlawyer.ca

60

The website canadianlawyer.ca is currently a parked domain with no active business content or services. It primarily serves advertisements through Bodis and Google Adsense, indicating a business model focused on domain parking and monetization rather than providing legal or media services. The site lacks any identifiable company information, contact details, or social media presence, limiting its engagement with users and potential clients. Technically, the site is hosted via Bodis nameservers and does not employ modern security measures such as SSL/TLS encryption, DNSSEC, or security headers, resulting in a low security posture. Performance is suboptimal with a slow page load time and minimal mobile optimization. Privacy compliance is minimal, with a privacy policy page present but no cookie consent mechanism or GDPR compliance indicators. Overall, the site presents a low-trust, low-engagement profile with significant room for improvement in security, user experience, and business transparency.

A

Alfahosting GmbH

alfahosting.de

60

Alfahosting GmbH is a well-established German web hosting provider founded in 1999, offering a broad range of hosting services including webhosting, domains, servers, reseller hosting, and office products such as Microsoft 365. Positioned as a market leader with multiple awards and a strong customer satisfaction rating, Alfahosting targets both beginners and professional users in Germany. Their infrastructure is hosted in Germany, emphasizing security, availability, and green IT initiatives. Technically, the website uses modern JavaScript libraries and tracking tools, with a custom CMS and a moderate performance profile. Security posture is good with strong TLS configuration and SPF/DMARC email protections, but lacks DNSSEC, HSTS, and OCSP stapling, which are recommended for improvement. The company demonstrates GDPR compliance with a comprehensive privacy policy and cookie consent mechanism. Overall, Alfahosting presents a professional, trustworthy, and customer-focused digital presence with room for security enhancements.

S

Ströer

plakate-buchen.de

57

Plakate-Buchen.de is an online advertising booking platform operated by Ströer, focusing on poster and campaign advertising across Germany. The platform offers access to over 300,000 advertising locations with daily updated availability and convenient online payment options, targeting businesses seeking to promote their stores or campaigns locally. The website is primarily in German and provides a phone contact for customer inquiries but lacks visible email contacts or terms of service. Technically, the site runs on an Apache server with modern TLS protocols (TLS 1.3 and 1.2) and uses Google Tag Manager for analytics and tracking. Security headers such as Strict-Transport-Security and X-Content-Type-Options are present, but improvements are needed in HSTS configuration, OCSP stapling, DMARC, DNSSEC, and certificate transparency compliance. The site implements cookie consent with express consent type, aligning with basic GDPR requirements but lacks comprehensive privacy and security policies. Overall, the platform demonstrates a moderate security posture with room for enhancement in email security and transport layer protections.

S

SCHUFA

schufa.de

48

SCHUFA is a major German credit bureau specializing in credit scoring and risk assessment services for consumers and businesses. The website is currently protected by a FriendlyCaptcha challenge, indicating active bot mitigation measures. However, the site lacks visible privacy, cookie, or terms of service policies on the captcha landing page, and no direct contact information is provided. The DNS configuration shows strong email authentication with SPF and DMARC policies, but the SSL/TLS configuration is critically lacking, with no valid certificate or secure protocols enabled. This presents a significant security risk for users and the business. The technical infrastructure relies on external captcha services and is hosted via United Domains nameservers. Performance is moderate but user experience and content quality are poor due to the captcha gate and lack of accessible content.

D

DKB Grund GmbH

dkb-grund.de

61

DKB Grund GmbH is a German real estate company specializing in property sales, financing, insurance, and investment services. With over 25 years of experience, it serves private and commercial clients across Germany. The website presents a comprehensive portfolio of services including property valuation, financing certificates, and energy-saving advice, supported by a strong regional presence and recognized industry partnerships. Technically, the site uses modern web technologies and analytics tools but currently lacks a valid SSL certificate, which impacts its security posture. The company demonstrates good GDPR compliance with a clear privacy and cookie policy and employs consent management tools. However, there is no explicit security policy or incident response information available. Overall, the website is professionally designed, user-friendly, and trustworthy, but the lack of HTTPS is a critical security gap that should be addressed promptly.

S

Saulės spektras, UAB

turizmas.lt

44

Turizmas.lt is a Lithuanian tourism portal operated by Saulės spektras, UAB, providing a comprehensive directory of travel-related services including accommodation, rural tourism, travel agencies, and leisure activities. The platform targets both local and international tourists seeking detailed information and booking options within Lithuania. The website demonstrates a solid market position as a national tourism information hub with a medium-sized business model based on listings and advertising revenue. Technically, the site uses a modern but somewhat traditional tech stack including Google Analytics, Bootstrap, and CKEditor, hosted by Hostex.lt. Performance is moderate with good mobile optimization and SEO practices. Security-wise, the site employs a valid SSL certificate with strong cipher suites but lacks advanced DNS security features such as DNSSEC and CAA records. Cookie and privacy policies are comprehensive and GDPR compliant, with a consent mechanism implemented. However, there is no visible terms of service or incident response policy. Overall, the site is professional, trustworthy, and well-branded, but could improve security posture and transparency in some areas.

A

ApexBrasil

investinbrasil.com.br

54

ApexBrasil operates as the Brazilian government's official trade and investment promotion agency, providing comprehensive support and information to international investors interested in Brazil. The website serves as a detailed portal showcasing Brazil's economic strengths, key investment sectors, and regional opportunities, positioning ApexBrasil as a critical facilitator for foreign direct investment. Technically, the site is built on Adobe Experience Manager, leveraging Adobe's marketing and analytics tools, but suffers from critical SSL/TLS misconfigurations that undermine its security posture. While security headers are partially implemented, the absence of a valid SSL certificate and modern TLS protocols presents significant risks. Contact information is clearly presented with official emails and physical addresses, enhancing trust. However, the lack of visible privacy, cookie, and terms of service policies indicates compliance gaps. Overall, the site is professional and content-rich but requires urgent security improvements to protect user data and maintain credibility.

P

PwC-Stiftung

galerie-pwc-stiftung.de

61

The PwC-Stiftung website galerie-pwc-stiftung.de serves as a digital gallery and archive showcasing 20 years of cultural and educational projects and programs supported by the PwC-Stiftung foundation in Germany. The foundation focuses on promoting cultural education and youth engagement through funding and running various initiatives. The website is professionally designed with good content relevance and navigation, targeting educational institutions, cultural organizations, and youth audiences. Technically, the site uses modern web technologies with deferred JavaScript and CSS, hosted on a provider identified as netzhaut. Security posture is moderate with valid TLS protocols but lacks advanced security features such as HSTS, DNSSEC, and DMARC, which are recommended for improvement. Privacy policy is present and GDPR compliant, but no cookie consent mechanism or terms of service are found. Overall, the site is trustworthy and well-positioned as a non-profit educational foundation's digital presence.

H

Hostinger

hostinger.com.br

63

Hostinger is a well-established global web hosting and domain registration provider founded in 2004, serving over 3 million users worldwide. The company offers a comprehensive suite of services including shared hosting, VPS, cloud hosting, WordPress optimized hosting, domain registration, and AI-powered website builders. Their market position is strong, supported by numerous trust indicators such as WordPress.org recommendation, Trustpilot reviews, and a 30-day refund policy. Technically, Hostinger employs modern web technologies including Nuxt.js and Vue.js, with integrations for Google Tag Manager, Microsoft Clarity, and Bing Ads, indicating a mature digital infrastructure. Security measures include valid SSL certificates, SPF and DMARC records with strict policies, though improvements can be made by enabling HSTS and DNSSEC. Overall, Hostinger demonstrates a solid security posture with no evident vulnerabilities and a good compliance level. The website is professionally designed, optimized for mobile, and provides a seamless user experience with clear navigation and comprehensive content. Strategic recommendations include enhancing security headers, implementing DNSSEC, and maintaining regular audits of third-party scripts to further strengthen security and trust.

H

Hi, I'm Tobias. | rixx.de

rixx.de

47

The website rixx.de serves as a personal hub for Tobias, an open source software author, conference speaker, and community organizer primarily in the technology sector. The site highlights his projects, blog posts, and involvement in events such as Chaos Communication Congress and DjangoCon Europe. The business model centers on personal branding and community engagement rather than commercial transactions. Technically, the site is built with standard web technologies including HTML, CSS, and JavaScript, with hosting provided by INWX. Performance is moderate, and SEO is well addressed through metadata, but mobile optimization and accessibility are basic. Security posture is weak due to the absence of a valid SSL certificate, lack of TLS support, missing security headers, and no DNSSEC. SPF is configured correctly, but other email authentication and security mechanisms are minimal. No privacy, cookie, or terms policies are published, and no contact information is explicitly provided on the site. Overall, the site is trustworthy for its niche audience but requires significant security and compliance improvements to enhance user trust and data protection.

L

LWND Kreativagentur GmbH

lwnd.com

50

LWND Kreativagentur GmbH is a small Austrian creative agency specializing in providing customized teams of specialists across various disciplines to drive brand success. The company positions itself as a modern and innovative agency with a strong focus on digital marketing, branding, campaigns, and UX design. Their website showcases a comprehensive portfolio of services, detailed case studies, and a professional team presentation, targeting brands and companies seeking tailored creative solutions. Technically, the website uses common web technologies such as jQuery, Swiper, and Google reCAPTCHA, hosted on Hetzner infrastructure. However, the site suffers from a critical security weakness due to the absence of a valid SSL/TLS certificate and lack of HTTPS support, which undermines user trust and data protection. DNS and email security configurations are properly implemented with SPF and DMARC policies. Overall, the website demonstrates excellent content quality and branding consistency but requires urgent security improvements to protect user data and comply with best practices.

B

Berenberg

berenberg.de

65

Berenberg is a historic private bank and financial services provider founded in 1590 in Hamburg, Germany. It offers wealth management, asset management, corporate banking, and investment banking services to a diverse clientele including wealthy private clients, corporations, and institutional investors. The bank maintains a strong market position in Europe and the US with multiple offices and a broad service portfolio. Technically, the website employs modern web technologies with good performance and mobile optimization, supported by a robust SSL configuration and DNS setup. Security practices include SPF and DMARC email protections, OCSP stapling, and strong cipher suites, though improvements such as enabling HSTS and DNSSEC could enhance security further. Overall, Berenberg demonstrates a mature digital presence with strong trust indicators and compliance with GDPR and cookie consent regulations.

D

Deutsche Bank AG

deutsche-bank.de

64

Deutsche Bank AG is a leading financial institution offering a wide range of banking and investment services primarily targeting private, corporate, and institutional clients in Germany and internationally. The website reflects a mature digital presence with comprehensive service offerings, strong branding, and user-centric design. The technical infrastructure leverages Adobe Experience Manager CMS, Adobe Launch for tag management, and integrates advanced customer interaction tools such as Genesys widgets and Usercentrics for consent management. Security configurations are solid with valid SPF and DMARC policies, TLS 1.2 encryption with strong cipher suites, but could benefit from enhancements like TLS 1.3 support, HSTS, and DNSSEC. Privacy and cookie policies are well implemented with GDPR compliance, though explicit security and incident response policies are not publicly found. Overall, the site demonstrates a high level of professionalism, trustworthiness, and compliance with regulatory requirements.

C

Clay Paky s.r.l.

e-assist.tech

54

Clay Paky s.r.l. operates the e-assist.tech website, providing an entertainment after sales service information support tool primarily targeting professionals in the entertainment industry. The platform offers user login capabilities and data request forms to facilitate after sales support. The company positions itself as a niche service provider within the entertainment technology sector, with a medium-sized business footprint based in Italy. The website content is basic but functional, with legal and privacy links present, though lacking advanced user engagement or marketing features. Technically, the site uses UIkit and standard web technologies but suffers from slow load times and lacks modern CMS or platform integrations. Security posture is weak, with no valid SSL certificate, no DNSSEC, and minimal security headers, exposing users to potential risks. There is no visible incident response or vulnerability disclosure policy, and GDPR compliance mechanisms are minimal. Overall, the site requires significant improvements in security and performance to meet modern standards and build user trust.

LexisNexis operates as a leading provider of legal, regulatory, and business information services, targeting primarily legal professionals and researchers. The website analyzed is a secure sign-in portal for accessing their research services, reflecting a mature enterprise-level business model with a strong market position. The company provides comprehensive customer support with multiple international phone numbers and maintains clear links to privacy and terms of service policies, demonstrating regulatory awareness and user transparency. Technically, the site employs standard web technologies including jQuery and OneTrust for cookie consent management. While the SSL certificate is valid and issued by a reputable CA, the absence of modern TLS protocols and security headers indicates room for improvement in security hardening. Performance is moderate to slow, and mobile optimization is basic, suggesting potential areas for technical enhancement. From a security perspective, the site shows good foundational practices such as valid SSL and cookie consent but lacks advanced security headers, DNSSEC, and CAA records. No explicit security policies, incident response contacts, or vulnerability disclosure mechanisms were found, which could be addressed to improve security posture and user trust. Overall, the website is professional and trustworthy but would benefit from technical and security upgrades to align with best practices and compliance standards.

L

LexisNexis Risk Solutions

bankersalmanac.com

75

Bankers Almanac is a specialized portal operated by LexisNexis Risk Solutions, providing financial institutions with access to banking data and KYC compliance tools. Positioned as an enterprise-grade service, it supports risk management and regulatory compliance needs for banking professionals. The website serves primarily as a login gateway to these services, integrating modern authentication via Auth0 and linking to corporate LexisNexis resources. Technically, the site employs standard web technologies but lacks modern TLS protocol support and DNSSEC, which are areas for improvement. Security posture is solid with valid SSL and HSTS enabled, but could benefit from enhanced security headers and DNS protections. Overall, the site demonstrates a professional and trustworthy presence aligned with enterprise financial services.

V

Volkswagen Financial Services

volkswagen-versicherungsdienst.de

65

Volkswagen Financial Services AG operates the volkswagen-versicherungsdienst.de website, providing a comprehensive portfolio of automotive insurance products including liability, partial and full coverage, warranty extensions, leasing rate insurance, credit protection, and travel insurance. The site targets primarily German private and business customers, leveraging the strong Volkswagen brand and integrated financial services ecosystem. The website is built on Adobe Experience Manager with extensive use of modern web technologies and content delivery networks, ensuring excellent performance and user experience. However, the SSL configuration is critically flawed with a self-signed certificate and no enabled TLS protocols, which undermines secure communications. Security headers are well implemented, but the absence of a cookie consent mechanism and explicit security or incident response policies indicates gaps in compliance and transparency. The site integrates multiple marketing and analytics tools, including Adobe Analytics, Google Tag Manager, and UserZoom, reflecting extensive user tracking. Overall, the site is professional, content-rich, and trustworthy from a business perspective but requires urgent security improvements to protect user data and comply with best practices.

A

A3 WEB

a3web.fr

53

A3 WEB is a French digital agency based in Cholet specializing in the creation of websites, SEO, SEA campaigns, mobile applications, and webmarketing services. With over 20 years of experience, the agency serves primarily small to medium-sized enterprises and local businesses in the Maine-et-Loire and Vendée regions. Their service offerings include bespoke website development, e-commerce solutions, mobile app development using Ionic, and comprehensive digital marketing strategies. The agency emphasizes local presence and personalized client relationships, supported by a professional website with strong SEO and marketing integrations. Technically, the website is built on WordPress with a suite of plugins including Yoast SEO, Ninja Forms, WP Rocket, and Complianz for GDPR compliance. The site uses a valid SSL certificate but lacks modern TLS protocol support and some advanced security headers. Hosting and email services appear to be provided by OVH. Performance is optimized with caching and lazy loading, and the site is mobile-friendly with good SEO practices including structured data. From a security perspective, the site has a valid SSL certificate and no known major vulnerabilities but lacks DNSSEC and HSTS enforcement. Cookie consent is managed properly with a consent mechanism in place. No explicit security policy or incident response information is found. The agency demonstrates good privacy compliance with a comprehensive privacy policy and cookie policy. Overall, A3 WEB presents a solid digital presence with a focus on local market needs, good technical infrastructure, and a moderate security posture. Strategic improvements in security protocols and enhanced transparency on terms of service and incident response would strengthen their trustworthiness and compliance posture.

S

SuranceBay LLC

surancebay.com

75

SuranceBay LLC operates a leading SaaS platform focused on insurance agent onboarding and compliance, positioning itself as the industry's number one solution in this niche. Their platform, SureLC, streamlines and automates insurance distribution processes, serving carriers, agencies, producers, and third-party administrators. The company demonstrates a solid market presence with a medium-sized operation based in the United States. Technically, the website is well-structured with modern web technologies, good SEO, and mobile optimization. The hosting infrastructure is based on Amazon AWS, and the site employs Google Tag Manager for analytics. Security-wise, the site benefits from a valid SSL certificate issued by Go Daddy and robust HTTP security headers including HSTS with preload, X-Frame-Options, and Content Security Policy. However, the absence of enabled TLS protocols is a critical security gap that should be addressed promptly. The company maintains comprehensive legal documentation including privacy policy and terms of service, but lacks visible cookie consent mechanisms and vulnerability disclosure policies. Overall, SuranceBay presents a professional and trustworthy digital presence with room for security enhancements.

R

RED Digital Cinema, Inc.

red.com

68

RED Digital Cinema, Inc. is a leading manufacturer of professional digital cinema cameras, offering advanced modular camera systems such as the V-RAPTOR and KOMODO lines. The company targets professional filmmakers and broadcast professionals, maintaining a strong market position through innovation in large format global shutter technology. Their business model focuses on direct sales, supported by a dealer network and educational resources. Technically, the website is built on SuiteCommerce Advanced hosted on AWS with strong branding and good mobile optimization. Security posture is solid with valid SSL certificates and strong security headers, though modern TLS protocols are not enabled and no explicit cookie consent mechanism is present. Privacy and terms policies exist but GDPR compliance is not explicitly stated. Overall, the site demonstrates high professionalism and trustworthiness with room for security and compliance improvements.

A

AlphaTauri GmbH

alphatauri.com

72

AlphaTauri GmbH operates a premium fashion e-commerce platform focused on innovative textile technologies and purposeful design. The company targets men and women seeking aspirational styles and premium materials, positioning itself as a technologically advanced fashion brand. The website demonstrates a mature digital infrastructure with modern web technologies, comprehensive navigation, and strong branding consistency. Security measures include a valid SSL certificate with HSTS and secure cookie settings, although TLS protocols are not currently enabled. Privacy and terms policies are clearly linked and GDPR compliant, with cookie consent mechanisms in place. The site integrates marketing and analytics tools such as New Relic, Google Tag Manager, Exponea, and Gigya, reflecting a moderate level of user tracking balanced with privacy compliance. Overall, the website presents a professional, trustworthy, and well-optimized online retail experience.

テ

テレシー(TELECY) - 運用型テレビCMを軸として総合コミュニケーションサービスを提供

telecy.tv

56

Telecy.tv is a Japanese media company specializing in operational television commercial (TVCM) services and integrated communication strategies. The company offers end-to-end marketing communication solutions centered on TV advertising, including strategy planning, creative development, media execution, and performance analysis. Positioned as a medium-sized enterprise, Telecy operates under the parent company CARTA HOLDINGS and partners with major advertising firms such as Dentsu. The website reflects a professional and consistent brand image targeting marketing professionals and advertisers in Japan. Technically, the site is built on WordPress, uses Cloudflare for hosting and caching, and integrates modern marketing tools like Google Tag Manager and a chatbot service. However, the SSL configuration lacks modern TLS protocol support, and there is no visible cookie consent mechanism, which may impact compliance.

N

Nvytes, Inc.

nvytes.co

78

Nvytes, Inc. operates a website promoting participation in the BDNY 2023 event, offering complimentary trade fair exhibition passes with promo codes and booth visit information. The business model appears focused on event marketing and promotion targeting trade fair attendees and exhibitors. The website content is minimal and uses placeholders, indicating dynamic content generation or incomplete deployment. Technically, the site uses standard web technologies including Google Fonts, FontAwesome, and video embedding from Vimeo and YouTube, hosted on AWS infrastructure. However, the site lacks a valid SSL certificate and does not enforce HTTPS, which significantly impacts security posture. The Content Security Policy is present but only in report-only mode, and other security headers are minimal. No privacy, cookie, or terms of service policies are found, and no contact or social media information is provided, limiting trust and compliance visibility. Overall, the site demonstrates a basic technical setup with significant security and compliance gaps.

M

MrSlotty

mrslotty.com

58

MrSlotty is a medium-sized B2B gaming content provider specializing in HTML5 slot games with certified RNG, targeting online casino operators and players globally. The company offers a portfolio of 40 Full HD quality slot games supporting multiple currencies including cryptocurrencies, with a focus on mobile and web platforms. Their market position is supported by partnerships with numerous casino operators and technology providers, as well as positive industry testimonials. Technically, the website is hosted on Cloudflare with a valid SSL certificate but lacks modern TLS protocol support and security headers such as HSTS. The contact form is protected by CSRF tokens and Cloudflare Turnstile CAPTCHA, indicating some security awareness. However, the absence of privacy, cookie, and terms of service policies, as well as lack of explicit incident response or data protection officer information, indicates compliance gaps. Overall, the site demonstrates good design and user experience but requires improvements in security posture and regulatory compliance.

E

Exterro

exterro.net

73

The website demonstrates a generally solid security posture with no critical issues and strong SSL/TLS implementation. However, significant gaps exist in compliance with GDPR and NIS2 regulatory frameworks, reflected by low module scores and several high-severity findings. The absence of fundamental policies such as cookie consent and incident response, coupled with exposure of high-risk services like FTP, present notable operational and reputational risks. Email and DNS security are reasonably well managed, though improvements can be made to further reduce threat vectors. Security headers are mostly configured correctly, but minor enhancements would strengthen protection against common web-based attacks. Immediate attention to regulatory compliance and incident management will mitigate potential legal and business continuity risks. Overall, the organization should prioritize closing governance and policy gaps to improve resilience and trust with customers and regulators.

N

NORGATE.LV SIA

norgate.lv

49

The website exhibits a weak overall security posture with critical gaps in privacy compliance, security headers, and core security policies. There is a critical GDPR compliance failure due to the absence of privacy and cookie policies, as well as no cookie consent mechanism, exposing the business to regulatory and reputational risks in the EU market. Security headers are largely missing, increasing vulnerability to common web-based attacks such as clickjacking, cross-site scripting, and data injection. The SSL/TLS configuration is suboptimal with weak keys and impending certificate expiration, risking data interception and trust issues. Absence of a formal information security framework, incident response plan, and security documentation further increases operational risks and slows incident handling. Exposure of high-risk services like FTP and lack of DNSSEC can be exploited by attackers to gain unauthorized access or manipulate traffic. While email security and DNS health scores are relatively better, they still require improvements to prevent spoofing and domain abuse. Overall, the website is at high risk for security breaches, non-compliance fines, and damage to customer trust unless prompt remediation occurs.

M

Mondly by Pearson

mondly.com

64

The website demonstrates a moderately strong network and SSL/TLS security posture but exhibits significant gaps in privacy compliance and security governance. Critical issues were avoided, but the presence of multiple high-severity findings—particularly missing privacy policies, lack of security framework documentation, and DNS misconfigurations—pose substantial risks to regulatory compliance and operational security. GDPR non-compliance related to the absence of privacy and cookie policies, as well as missing consent mechanisms, exposes the business to legal penalties and reputational damage. Similarly, deficiencies in incident response, vulnerability disclosure, and business continuity planning highlight unpreparedness for cyber incidents, which can lead to prolonged outages and data breaches. The missing Content-Security-Policy header and weak HTTP security headers increase susceptibility to client-side attacks. DNS misconfigurations, such as an unregistered MX record, threaten email reliability and business communications. Immediate remediation in these areas will significantly reduce risk exposure and improve trust with users and regulators.

E

Equiniti

equiniti.com

75

The website demonstrates a generally solid security posture in areas such as network security, email security, and SSL/TLS implementation, with high module scores in these domains. However, significant gaps exist in compliance with GDPR and NIS2 regulatory frameworks, reflected by low scores and multiple high-severity findings. The absence of essential policies—such as cookie consent, incident response, and security documentation—poses considerable legal, operational, and reputational risks. Missing GDPR elements could lead to regulatory penalties and erosion of customer trust, while lack of NIS2 alignment may expose the business to increased vulnerability and non-compliance fines. Medium-level risks related to security headers, DNS security features, and mixed content issues could be exploited to compromise data confidentiality and integrity. Immediate attention to regulatory compliance and incident preparedness will strengthen the organization’s resilience and legal standing. Overall, the business should prioritize addressing compliance and policy shortcomings to mitigate risks and safeguard stakeholder confidence.

M

Medibank Private Limited

medibank.com.au

73

The website demonstrates a moderate overall security posture with no critical vulnerabilities detected, but several high and medium-risk issues require urgent attention. Key compliance gaps exist in GDPR adherence, notably the absence of a cookie policy and consent banner, which expose the business to regulatory penalties and reputational damage. The NIS2-related security framework and incident response capabilities are severely lacking, indicating unpreparedness for cyber incidents and potential operational disruptions. Security headers and SSL/TLS configurations are generally adequate but have room for improvement to mitigate common web-based attacks. DNS health and network security score well, reflecting a solid underlying infrastructure. Email security is robust, reducing phishing risks via email vectors. Prioritizing GDPR compliance and establishing formal security policies will significantly reduce legal and operational risks. Immediate remediation will enhance customer trust and regulatory standing, supporting long-term business resilience.

V

Velocity Frequent Flyer Pty Limited

velocityfrequentflyer.com

68

The website demonstrates a moderate security posture with no critical vulnerabilities detected but multiple high and medium-risk issues that expose the organization to regulatory, reputational, and operational risks. Key weaknesses lie in missing essential security headers, lack of compliance with GDPR requirements, and absence of fundamental NIS2 cybersecurity governance frameworks. While foundational network and email security measures are strong, gaps in security policy documentation, incident response readiness, and privacy transparency present significant business risks. Failure to implement privacy policies and consent mechanisms may lead to regulatory fines and loss of customer trust. Additionally, missing headers like Strict-Transport-Security and Content-Security-Policy increase exposure to man-in-the-middle and cross-site scripting attacks. The organization should prioritize closing these gaps to protect sensitive information, ensure regulatory compliance, and maintain customer confidence. Immediate remediation combined with policy development and communication enhancements is essential to strengthen overall security posture.

V

Virgin Media Business

virginmediabusiness.co.uk

72

The website demonstrates a generally strong technical security foundation with good network security (100/100) and solid scores in DNS health (90/100), SSL/TLS (87/100), and security headers (85/100). However, significant gaps exist in regulatory compliance and organizational security management, particularly around GDPR and NIS2 requirements, which are critical for legal adherence and incident readiness. The absence of a cookie policy and consent banner exposes the business to regulatory penalties and damages customer trust. Lack of security policy documentation, incident response procedures, and business continuity planning present serious operational risks in the event of a security incident. Email security is adequate but could be improved by implementing DKIM to prevent spoofing. Addressing these compliance and procedural shortcomings is essential to mitigate legal risks, maintain customer confidence, and ensure resilience against cyber threats. Overall, the site’s technical defenses are strong, but governance and compliance need urgent focus to reduce business risk.

W

WEB.DE

web.de

68

The website's overall security posture reveals significant compliance and governance gaps, particularly concerning GDPR and NIS2 regulatory requirements, which present substantial legal and reputational risks. While technical controls such as SSL/TLS encryption, email security, DNS health, and network security are generally strong, critical deficiencies in privacy policies, cookie management, and incident response frameworks undermine stakeholder trust and regulatory compliance. The absence of a cookie consent banner and adequate privacy measures for EU users exposes the business to potential fines under GDPR. Additionally, the lack of documented security policies, incident response procedures, and business continuity planning under NIS2 regulations increases operational vulnerability to cyber incidents. Security headers are improperly configured, which can lead to exploitation of common web vulnerabilities. Immediate remediation is essential to mitigate legal penalties, safeguard customer data, and maintain business continuity. Addressing these issues will strengthen compliance posture and enhance overall cybersecurity resilience.

C

Cleartrip

cleartrip.com

70

The website demonstrates a strong foundation in core network, email, and SSL/TLS security, evidenced by high scores in these areas. However, significant gaps exist in web security headers, GDPR compliance, and adherence to NIS2 security standards, exposing the business to regulatory risks and potential reputational damage. Critical privacy policies and user consent mechanisms are missing, which can lead to non-compliance fines and loss of customer trust. The absence of an incident response plan and security policy documentation further increases operational risk in the event of a security breach. Additionally, missing key HTTP security headers weakens defenses against common web-based attacks. While DNS security is generally healthy, the lack of DNSSEC implementation leaves potential vulnerabilities unmitigated. Overall, the website requires urgent attention to governance, compliance, and web security controls to minimize legal, financial, and operational risks.

I

IMDb.com, Inc.

boxofficemojo.com

68

The website demonstrates a moderate security posture with no critical issues found but several high and medium severity vulnerabilities that require immediate attention. Key weaknesses lie in missing essential HTTP security headers, lack of GDPR compliance measures, and inadequate adherence to NIS2 security frameworks. These gaps expose the business to risks such as clickjacking, cross-site scripting, regulatory non-compliance, and operational disruption due to lack of incident response and security policies. On a positive note, email security, SSL/TLS configuration, DNS health, and network security show strong performance, reducing exposure to common attack vectors. However, the absence of cookie consent mechanisms and security documentation significantly increases legal and operational risks. Addressing these issues promptly will improve customer trust, regulatory compliance, and overall resilience against cyber threats. Prioritizing governance and policy-based controls alongside technical fixes is critical for sustainable security posture enhancement.

I

Indus Appstore Private Limited

indusappstore.com

75

The website demonstrates a generally stable security posture with no critical vulnerabilities detected; however, several high and medium risk issues undermine its overall resilience and regulatory compliance. Key weaknesses are evident in governance and compliance areas, notably the absence of GDPR cookie policies and consent mechanisms, as well as lack of documented security policies aligned with NIS2 requirements. Security headers are partially implemented, exposing the site to potential client-side attacks. While SSL/TLS and email security are strong, impending certificate expiration and missing DNSSEC reduce trust and resilience. The absence of incident response and business continuity plans further increases operational risk. Immediate remediation of compliance and governance gaps is essential to avoid regulatory penalties and reputational damage. Strengthening security headers and enabling DNSSEC alongside proactive certificate management will enhance technical defenses and stakeholder confidence.

A

Amazon.com, Inc.

amazonpay.in

70

The website demonstrates a generally strong technical security foundation with excellent SSL/TLS and network security postures and solid email security and DNS health scores. However, significant gaps exist in compliance with GDPR and NIS2 regulatory frameworks, posing substantial legal, reputational, and operational risks. Critical deficiencies include the absence of key privacy policies, cookie consent mechanisms, and comprehensive security governance documentation such as incident response and security policies. Security header configurations are suboptimal but represent a lower risk compared to compliance failures. The lack of vulnerability disclosure policies and business continuity planning further exposes the organization to prolonged downtime and unaddressed security incidents. Addressing these compliance and governance issues is essential to mitigate regulatory penalties, build customer trust, and ensure resilience against cyber threats. Immediate remediation will strengthen the overall security posture and align the organization with industry best practices and legal requirements.

A

Australia Post

digitalid.com

76

The website demonstrates a generally strong technical security posture in areas such as email security, SSL/TLS configuration, DNS health, and network security, reflecting effective implementation of foundational controls. However, significant gaps exist in compliance and governance domains, notably regarding GDPR and NIS2 requirements, which pose substantial legal, reputational, and operational risks. The absence of a privacy policy, cookie policy, and consent mechanisms undermines user trust and exposes the business to potential regulatory penalties. Furthermore, critical deficiencies in information security frameworks, incident response, and security policy documentation indicate a lack of formalized cybersecurity governance and preparedness. While security header implementations are moderate, enhancements are needed to reduce exposure to web-based threats. Addressing these compliance and governance gaps will be essential to align with industry best practices, regulatory mandates, and customer expectations. Prioritizing these improvements will strengthen both risk management and stakeholder confidence.

C

Cure Kids

rednoseday.co.nz

66

The website demonstrates a moderate overall security posture with no critical issues detected; however, there are multiple high and medium severity gaps that present significant risk to business operations and compliance. Key vulnerabilities include lack of foundational security headers and insufficient email authentication, which increase exposure to web-based attacks and phishing risks. Compliance with GDPR and NIS2 regulations is notably weak, with missing cookie consent mechanisms, security policies, and incident response procedures that could lead to regulatory penalties and reputational damage. While network and DNS security are relatively strong, the absence of core security policies and frameworks undermines the organization's resilience against cyber threats. Immediate remediation is critical to protect sensitive customer data, ensure regulatory compliance, and maintain business continuity. Addressing these issues will also improve customer trust and reduce the likelihood of data breaches. Prioritizing security governance and visibility should be central to the remediation roadmap. Overall, the organization must advance beyond technical fixes to establish a robust security culture aligned with regulatory expectations.

This website has 3 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

This website has 8 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

B

BforBank

bforbank.com

93

This website has 6 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

The website demonstrates a generally strong security posture with no critical or high-severity issues detected, reflecting effective baseline security controls. SSL/TLS and network security configurations are robust, scoring 100/100, which helps ensure secure data transmission and resilience against network attacks. However, several medium-severity issues related to compliance and security best practices remain unresolved, including missing security headers, lack of GDPR and NIS2 compliance validation, and DNS security gaps such as absent DNSSEC. Email security is moderate, with a complex SPF record but lacking DKIM signatures, which can increase the risk of email spoofing and phishing. Low-severity issues like missing CAA records indicate room for improvement in certificate management. Addressing these medium-level findings is critical not only to enhance security but also to maintain regulatory compliance and protect brand reputation. Overall, while the site is secure enough to support business operations currently, targeted improvements will reduce risk exposure and strengthen trust with customers and partners.

The website demonstrates a generally strong security posture with no critical or high severity issues detected. SSL/TLS and network security configurations are robust, scoring a full 100, indicating secure encrypted communications and a solid network defense. However, medium-level weaknesses in email security, DNS configuration, and compliance frameworks present notable risks. The lack of DMARC enforcement and missing DKIM records increase the risk of email spoofing and phishing attacks, potentially harming brand reputation and customer trust. DNSSEC absence leaves domain name resolution vulnerable to spoofing or cache poisoning attacks. Additionally, incomplete security headers and failures in GDPR and NIS2 compliance checks indicate gaps in regulatory adherence and security best practices. Addressing these medium-level issues will significantly improve overall security resilience and regulatory compliance, safeguarding both operational integrity and customer data privacy.

The website demonstrates a strong overall security posture with no critical or high-risk issues identified. Key areas such as email security, SSL/TLS configurations, and network security are fully compliant and well managed, reflecting robust protection against common threats. However, several medium-level issues related to security headers, GDPR compliance, NIS2 readiness, and DNS health indicate gaps that could expose the business to regulatory and operational risks. The failure in security headers could weaken defenses against web-based attacks, while lacking DNSSEC and CAA records may increase vulnerability to DNS spoofing and unauthorized certificate issuance. GDPR and NIS2 analysis failures suggest potential non-compliance with important data protection and cybersecurity regulatory frameworks, which could result in legal and financial consequences. Addressing these medium and low-level issues promptly will enhance regulatory compliance, reduce attack surfaces, and strengthen overall resilience. Prioritizing these improvements aligns security efforts with business continuity and reputation protection goals.

K

KOTA

kota.co.uk

73

The website demonstrates a generally strong network and TLS security posture, with no critical vulnerabilities identified. However, significant gaps exist in GDPR compliance and NIS2 regulatory adherence, which pose legal and operational risks. High-severity issues such as the absence of a cookie policy, consent banner, security framework, incident response procedures, and security policy documentation undermine trust and regulatory standing. Medium-level risks like missing vulnerability disclosure and business continuity plans further amplify potential exposure to cyber threats and operational disruptions. Security headers and email security configurations are moderately implemented but require enhancements for better protection. Immediate focus on compliance and governance frameworks is essential to mitigate regulatory penalties and reputational damage. Addressing these weaknesses will strengthen overall security resilience and ensure alignment with legal requirements.

The website exhibits a moderate overall security posture with no critical vulnerabilities detected but several high and medium-risk issues that require immediate attention. GDPR compliance is notably weak, scoring 43/100, primarily due to the absence of a cookie policy and consent banner, exposing the business to regulatory risks and potential fines. The NIS2 compliance score is critically low at 25/100, reflecting significant gaps in information security governance, incident response, and security documentation, which could impair the organization’s ability to manage cyber threats and regulatory obligations. Security headers and email security are average but have room for improvement to mitigate common web and email-based attacks. SSL/TLS and DNS configurations are generally strong, but mixed content and missing DNSSEC reduce overall protection. Network security posture is excellent, indicating robust infrastructure defenses. Immediate remediation will reduce legal liability, enhance trust with customers, and strengthen the organization's resilience against cyber threats.