Security Directory

O

Origin Foundation

originfoundation.org.au

67

The website demonstrates a moderate security posture with no critical issues but several high and medium risks that could affect both compliance and operational security. Notably, the absence of key GDPR elements such as a cookie policy and consent banner exposes the business to regulatory penalties and customer trust erosion. Security headers are insufficiently configured, increasing the risk of common web attacks like clickjacking and cross-site scripting. The lack of a formal information security framework, security policies, and incident response procedures signifies significant gaps in organizational security governance, potentially delaying breach detection and response. Email security weaknesses, including missing SPF and DKIM records, increase the risk of phishing and email spoofing attacks that could harm brand reputation. DNS security is generally strong but could be further improved by enabling DNSSEC and configuring CAA records. SSL/TLS and network security are strong points, providing a secure communication baseline. Overall, immediate attention to privacy compliance and foundational security policies will materially reduce both business and security risks.

The website demonstrates a moderate overall security posture with no critical vulnerabilities detected, but several high and medium-risk issues significantly impact compliance and risk management. Key compliance gaps exist in GDPR and NIS2 requirements, including missing privacy and cookie policies, lack of incident response and security framework documentation, and absence of a cookie consent mechanism. While technical security controls like SSL/TLS, email security, DNS health, and network security score well, the absence of essential security headers and mixed content issues indicate potential exposure to web-based attacks. The missing privacy and security policies pose legal and reputational risks, especially under stringent data protection regulations. Addressing these compliance and policy issues should be prioritized to avoid regulatory penalties and maintain customer trust. Enhancing security headers and enabling DNSSEC will further reduce the attack surface and improve resilience. Overall, strengthening governance and policy frameworks alongside technical hardening is critical for a robust security posture and business continuity.

O

Origin Energy

originenergy.com.au

71

The website demonstrates a strong baseline in network security, SSL/TLS implementation, and email security, reflecting good foundational controls. However, significant gaps exist in compliance with GDPR and NIS2 regulatory frameworks, exposing the business to potential legal and operational risks. Missing privacy and cookie policies, along with the absence of a cookie consent mechanism, represent critical compliance failures that could lead to regulatory penalties and erode customer trust. The lack of documented information security and incident response policies further increases the risk of ineffective handling of security incidents. Security headers are partially implemented but miss key protections that safeguard against common web vulnerabilities. DNS security could be enhanced by enabling DNSSEC to prevent spoofing attacks. Addressing these issues will improve regulatory compliance, reduce legal exposure, and strengthen overall cybersecurity resilience.

The website demonstrates a generally solid security posture with no critical or high-risk issues detected and strong scores in SSL/TLS and network security. However, several medium-level vulnerabilities related to security headers, GDPR compliance, NIS2 requirements, email authentication, and DNS security suggest areas for improvement. The absence of key security headers and missing DKIM records expose the site to potential data interception and email spoofing risks. Non-compliance with GDPR and NIS2 frameworks could lead to regulatory penalties and reputational harm. DNSSEC is not enabled, increasing susceptibility to DNS spoofing attacks. Although low-risk issues such as missing CAA records are present, they should be addressed to further harden the environment. Proactively remediating these findings will enhance regulatory compliance, reduce attack surfaces, and foster greater customer trust.

V

Vets Beyond Borders

vetsbeyondborders.org

53

The website's overall security posture is concerning, with multiple critical and high-severity issues primarily related to missing security headers, inadequate GDPR compliance, and insufficient information security governance. Key vulnerabilities include exposure of critical services such as MySQL, lack of essential security policies, and missing privacy and cookie compliance mechanisms, which collectively increase legal, reputational, and operational risks. Email and TLS security measures are moderately implemented but require improvements to prevent phishing and data interception. DNS security is relatively strong but can be enhanced further. The absence of incident response and business continuity planning exposes the business to extended downtime and unmanaged breaches. Immediate attention is needed to reduce attack surface and ensure regulatory compliance to safeguard customer trust and avoid potential penalties. Without remediation, the company faces heightened risks of data breaches, service interruptions, and legal non-compliance.

G

GapOnly

gaponly.com.au

63

The website exhibits a concerning security posture with no critical issues but multiple high and medium severity vulnerabilities, particularly in security headers, GDPR compliance, and NIS2 regulatory adherence. Key security headers like Strict-Transport-Security, X-Frame-Options, and Content-Security-Policy are missing, exposing the site to common web-based attacks such as clickjacking and cross-site scripting. GDPR compliance gaps, including the absence of a cookie policy and consent banner, risk regulatory penalties and damage to customer trust. Additionally, the lack of documented security policies and incident response procedures puts the organization at risk of inadequate preparation for cyber incidents. SSL/TLS configurations are suboptimal, with weak key lengths and certificates nearing expiration, increasing the potential for man-in-the-middle attacks. DNS security is moderately healthy but could be improved by enabling DNSSEC. Network security and email security are strong points, which is positive but insufficient to offset the other deficiencies. Immediate remediation in these areas is essential to reduce risk, protect customer data, and maintain regulatory compliance.

C

Coles Group

colesgroup.com.au

73

The website demonstrates a generally stable security posture with no critical issues identified; however, several high and medium-level gaps present significant compliance and risk challenges. Key deficiencies include missing essential security headers and incomplete GDPR compliance, notably the absence of a cookie policy and consent mechanism, which could expose the business to regulatory penalties. The lack of an established information security framework, security policies, and incident response procedures severely undermines resilience against cyber threats and incident management. Email security is moderately sound but could be improved by implementing DKIM to prevent spoofing. Although network and SSL/TLS configurations are strong, issues like mixed content and missing DNSSEC pose potential attack vectors. Addressing these areas will enhance regulatory compliance, reduce liability, and strengthen overall risk management. Immediate attention to governance and privacy controls is critical to align with NIS2 and GDPR requirements and protect brand reputation.

L

Lancashirecapital

lancashirecapital.com

62

The website demonstrates significant security weaknesses primarily in its security headers, GDPR compliance, and adherence to the NIS2 framework, reflecting an overall inadequate security posture. There are no critical vulnerabilities reported; however, the presence of 12 high and 10 medium issues indicates serious risks that could expose the business to data breaches, regulatory penalties, and reputational damage. Missing essential HTTP security headers and lack of privacy and cookie policies undermine both user trust and legal compliance. The absence of documented information security policies, incident response plans, and business continuity strategies further increases the organization's operational risk. Additionally, network security concerns such as exposed FTP services present attack vectors that could be exploited. While email security and SSL/TLS configurations score relatively well, the impending SSL certificate expiry and lack of HSTS reduce the effectiveness of encrypted communications. Immediate remediation in these areas is critical to protect sensitive customer data, maintain compliance with regulations like GDPR and NIS2, and uphold business continuity.

The website's security posture is currently weak, with numerous high and critical severity issues that expose the business to significant risks including data breaches, regulatory non-compliance, and operational disruptions. Critical services such as MySQL and FTP are openly exposed, creating easy attack vectors for malicious actors. The absence of key security headers and lack of HTTPS enforcement undermine client trust and increase vulnerability to common web attacks. GDPR compliance gaps, including no cookie policy or consent mechanism, expose the company to regulatory fines and reputational damage. The lack of documented security frameworks, incident response, and business continuity plans indicate insufficient organizational readiness to handle security incidents. While email security and DNS health are relatively strong, foundational network and application security controls require urgent remediation. Overall, immediate focus on closing critical exposure points and establishing governance is essential to protect business assets and customer trust.

P

PetSure (Australia) Pty Ltd

petsure.com.au

66

The website security assessment reveals a concerning overall security posture, with no critical issues but multiple high and medium severity vulnerabilities primarily related to security headers, GDPR compliance, and NIS2 regulatory requirements. Key gaps include missing fundamental HTTP security headers, absence of essential GDPR cookie policies and consent mechanisms, and a lack of formalized information security, incident response, and business continuity frameworks. SSL/TLS configurations show weaknesses with expiring certificates and weak key lengths, raising risks of data interception. While email and network security measures are strong, DNS security can be improved. These vulnerabilities increase the risk of data breaches, regulatory fines, and reputational damage, highlighting an urgent need for remediation to protect business assets and maintain customer trust. Addressing these issues will also enhance compliance with evolving cybersecurity regulations such as NIS2 and GDPR.

L

Lancashire Inc.

lancashiregroup.com

76

The website demonstrates a generally stable security posture with no critical vulnerabilities detected, but notable gaps exist in compliance and governance areas. GDPR compliance is weak, primarily due to the absence of a cookie consent banner and insufficient privacy policy details, risking regulatory penalties. The NIS2 framework adherence is particularly poor, with multiple high-severity issues such as missing security policies, incident response procedures, and information security frameworks, exposing the business to operational and reputational risks. Technical security controls like email security, SSL/TLS configurations, and DNS health are fairly strong but can be further improved. Missing security headers and lack of advanced HTTP policies indicate opportunities to harden defenses. The lack of business continuity planning and vulnerability disclosure policies reduces the organization's preparedness for incidents and coordination with external security researchers. Enhancing these areas will not only improve security posture but also strengthen customer trust and regulatory compliance. Addressing these issues promptly will mitigate potential legal, financial, and operational impacts.

V

Virgin Australia Airlines Pty Ltd

virginaustralia.com

72

The website demonstrates a generally strong security posture in areas such as email security, SSL/TLS configuration, and network security, all scoring 100/100. However, critical gaps exist in compliance and governance domains, particularly related to GDPR and NIS2 frameworks, with scores as low as 25/100. High-severity issues include missing essential privacy policies, lack of cookie consent mechanisms, and absence of incident response and security policy documentation. The missing Content-Security-Policy header further exposes the site to cross-site scripting risks. DNS health is fairly good but can be improved by enabling DNSSEC and configuring CAA records. Overall, while technical defenses are solid, the lack of regulatory compliance and formal security governance poses significant business risks, including legal penalties and reputational damage. Immediate remediation in compliance and policy documentation is critical for maintaining trust and regulatory adherence.

A

Aegon

aegon.co.uk

68

The website demonstrates a solid foundational security posture in areas such as SSL/TLS configuration, network security, and email security, all scoring 85% or above. However, significant gaps exist in compliance with GDPR and NIS2 requirements, exposing the business to regulatory and reputational risks. The absence of privacy and cookie policies, along with missing consent mechanisms, creates legal vulnerabilities and undermines user trust. Key security headers are inadequately configured, increasing exposure to common web-based attacks like cross-site scripting. Additionally, the lack of documented information security frameworks, incident response plans, and business continuity strategies signals insufficient organizational readiness for cyber incidents. Medium-level DNS and email security issues further highlight areas for improvement to prevent spoofing and phishing attacks. Addressing these high-impact issues promptly will enhance regulatory compliance, strengthen security posture, and protect brand reputation.

N

Not Found

youraccountonline.com

67

The website's overall security posture reveals significant gaps, particularly in compliance with GDPR and NIS2 regulations, which pose legal and reputational risks. Critical vulnerabilities in email authentication and missing key security headers expose the business to phishing and man-in-the-middle attacks. Although network security and DNS health are relatively strong, foundational security policies and incident response processes are lacking, undermining resilience against cyber threats. The absence of a Privacy Policy, Cookie Policy, and Consent Banner further endangers compliance with data protection laws and customer trust. SSL/TLS implementation is adequate but requires immediate attention due to upcoming certificate expiration and missing HSTS enforcement. Addressing these issues promptly will reduce exposure to regulatory penalties, data breaches, and brand damage. Overall, the website requires urgent improvements in governance, technical controls, and privacy management to align with industry standards and legal frameworks.

Y

Yorkshire Bank

ybonline.co.uk

72

The website demonstrates a generally stable security posture with no critical vulnerabilities detected, and strong performance in email and network security. However, significant gaps exist in GDPR compliance and adherence to NIS2 regulatory requirements, posing legal and operational risks. The absence of a Privacy Policy and Cookie Consent Banner exposes the business to potential data protection violations and regulatory penalties. Deficiencies in security governance, such as missing incident response procedures and security policy documentation, increase the risk of inadequate breach handling. SSL/TLS configurations require improvement to prevent potential data interception and integrity issues. While DNS and network security are robust, enhancements in security headers and vulnerability disclosure practices are advisable. Addressing these issues promptly will reduce compliance risks, protect customer trust, and strengthen overall security resilience.

C

Clydesdale Bank

cbonline.co.uk

72

The website demonstrates a generally stable security posture with no critical vulnerabilities detected. However, significant gaps exist in compliance with GDPR and NIS2 requirements, exposing the business to regulatory, legal, and reputational risks. Key deficiencies include the absence of a Privacy Policy, cookie consent mechanisms, and essential security documentation such as incident response and business continuity plans. Additionally, SSL/TLS configurations require attention to prevent potential data interception and trust issues. While network and email security are strong, the lack of security headers and incomplete policies may undermine overall protection. Immediate focus on regulatory compliance and security governance will reduce exposure and support customer trust. Addressing these issues will also prepare the organization for evolving cybersecurity frameworks and audits.

The website demonstrates a generally strong security posture with no critical or high-level vulnerabilities detected, and excellent scores in SSL/TLS and network security. However, several medium-level issues indicate gaps in compliance and protective measures, particularly regarding security headers, GDPR compliance, NIS2 readiness, email authentication, and DNS security. These weaknesses could expose the business to data privacy risks, regulatory non-compliance penalties, and increased susceptibility to phishing or DNS-related attacks. While low-level issues such as missing CAA records are less urgent, addressing them will further strengthen the security framework. Prioritizing remediation of medium-risk findings will enhance overall resilience and maintain customer trust. Proactive improvements will also help ensure alignment with evolving regulatory and security standards.

V

Virgin Media Business

virginmediabusiness.co.uk

72

The website demonstrates a generally strong technical security foundation with good network security (100/100) and solid scores in DNS health (90/100), SSL/TLS (87/100), and security headers (85/100). However, significant gaps exist in regulatory compliance and organizational security management, particularly around GDPR and NIS2 requirements, which are critical for legal adherence and incident readiness. The absence of a cookie policy and consent banner exposes the business to regulatory penalties and damages customer trust. Lack of security policy documentation, incident response procedures, and business continuity planning present serious operational risks in the event of a security incident. Email security is adequate but could be improved by implementing DKIM to prevent spoofing. Addressing these compliance and procedural shortcomings is essential to mitigate legal risks, maintain customer confidence, and ensure resilience against cyber threats. Overall, the site’s technical defenses are strong, but governance and compliance need urgent focus to reduce business risk.

I

IONOS Inc.

ionos-status.com

73

The website demonstrates a mixed security posture with no critical vulnerabilities but multiple high and medium risk issues that could impact business operations and compliance. Key deficiencies include missing critical HTTP security headers, lack of GDPR compliance elements such as cookie policies and consent mechanisms, and absence of formalized security and incident response frameworks aligned with NIS2 requirements. While SSL/TLS and network security configurations are generally strong, the approaching SSL certificate expiration and weak HSTS settings present avoidable risks. The lack of documented security policies and incident response plans exposes the organization to increased operational and reputational risks in case of a breach. GDPR non-compliance may result in regulatory penalties and loss of customer trust. Immediate remediation in security headers, GDPR compliance, and NIS2 framework implementation is essential to strengthen the security baseline and meet regulatory obligations. Overall, this assessment highlights the need for a structured approach to security governance and technical hardening to reduce business risk effectively.

T

Telefónica Deutschland

telefonica.de

67

The website's overall security posture demonstrates strong technical controls in network security, SSL/TLS configuration, and DNS health, with scores above 85 in these areas. However, significant compliance and governance issues are present, particularly concerning GDPR and NIS2 requirements, resulting in low scores of 18 and 25 respectively. The critical GDPR finding highlights the absence of adequate privacy measures for an EU business, posing substantial legal and financial risks. High-priority gaps include missing cookie consent mechanisms, lack of documented security and incident response policies, and absence of a formal information security framework. Email security is moderate but requires improvements to prevent spoofing and phishing attacks. While low-severity issues exist, they are overshadowed by critical compliance deficiencies that could lead to regulatory penalties and reputational damage. Immediate remediation focusing on privacy compliance and governance frameworks is essential to mitigate legal exposure and strengthen customer trust.

X

Xodo

eversign.com

73

The website currently exhibits a moderate to low overall security posture, with critical issues notably absent but several high and medium severity vulnerabilities present. Key deficiencies exist in security header implementations, GDPR compliance, and adherence to NIS2 regulatory frameworks, indicating significant gaps in both technical and organizational security controls. The absence of fundamental headers such as Strict-Transport-Security and Content-Security-Policy increases risk exposure to common web attacks like man-in-the-middle and cross-site scripting. GDPR-related shortcomings, including lack of a cookie consent banner and incomplete privacy policies, expose the business to regulatory penalties and undermine customer trust. The failure to establish an information security framework, incident response procedures, and security documentation highlights weaknesses in governance and risk management. However, strengths are noted in email security, SSL/TLS configurations, DNS health, and network security, which provide a solid foundation for secure communications and infrastructure. Addressing the highlighted issues will substantially reduce risk, improve compliance, and safeguard brand reputation. Immediate focus on regulatory compliance and security policy development is crucial for sustainable business operations.

V

Vodafone Institut

vodafone-institut.de

71

The website demonstrates a generally strong posture in network security, email security, SSL/TLS, and DNS health, indicating robust foundational controls. However, it exhibits critical gaps in GDPR compliance, notably operating as an EU business without adequate privacy measures, which exposes the organization to significant legal and financial risks. The absence of key NIS2 cybersecurity framework elements, including incident response, security policies, and vulnerability disclosure, further heightens exposure to operational and regulatory threats. Security headers and mixed content issues suggest potential vulnerabilities to client-side attacks, albeit at a lower risk level. Overall, the site’s security is uneven, with high risks concentrated in regulatory compliance and governance areas that directly impact business continuity and reputation. Immediate attention is required to remediate compliance deficits and establish formalized security governance. Failure to address these could result in regulatory penalties, data breaches, and damage to customer trust. Strengthening these areas will align the business with industry best practices and reduce potential liabilities.

V

Vodafone Stiftung Deutschland gGmbH

vodafone-stiftung.de

71

The website exhibits a generally strong technical security posture in areas such as email security, SSL/TLS configuration, and network security. However, there are significant compliance and governance gaps, particularly related to GDPR and the NIS2 directive, exposing the business to legal and regulatory risks in the EU. Critical issues include missing privacy measures for EU users and the absence of a structured information security framework, incident response, and business continuity planning. Medium-level technical issues like missing security headers, mixed content, and lack of DNSSEC further weaken the security posture. The lack of cookie policy and consent mechanisms also jeopardizes user trust and compliance. Overall, while foundational security controls are present, urgent attention is needed on data privacy, regulatory compliance, and formalizing security policies to mitigate risk and avoid potential fines or reputational damage. Addressing these gaps will enhance legal compliance, customer confidence, and resilience against cyber threats.

I

INFIBEAM AVENUES

ccavenue.us

61

The website's overall security posture reveals significant gaps, particularly in critical areas such as email authentication, security headers, GDPR compliance, and information security governance. The presence of a critical email security issue (no email authentication configured) combined with several high-severity missing security headers exposes the website to risks like phishing, data interception, and clickjacking. GDPR compliance is weak, lacking cookie policies and consent mechanisms, which can lead to regulatory penalties and damage to customer trust. Additionally, the absence of documented security policies, incident response, and business continuity planning poses serious operational risks. While SSL/TLS and network security modules score relatively better, foundational security controls like HSTS and DNSSEC are not fully implemented. The low scores in NIS2 compliance indicate insufficient alignment with essential EU cybersecurity directives, impacting legal standing and resilience. Immediate remediation is crucial to protect business assets, maintain customer confidence, and ensure regulatory compliance.

C

CCAvenue

ccavenue.ae

66

The website demonstrates a moderate overall security posture with no critical issues detected but several high and medium-severity vulnerabilities that could expose the business to regulatory, reputational, and operational risks. Notably, GDPR compliance is weak, lacking essential cookie policies and consent mechanisms, increasing potential legal liabilities in privacy regulations. The absence of a formal information security framework, incident response procedures, and security policies indicates immature governance and preparedness, which could hinder effective breach management. Security headers are partially implemented but missing key protections like Content-Security-Policy, leaving the site vulnerable to client-side attacks. Email security configurations such as DMARC and DKIM require improvement to prevent phishing and spoofing threats. While SSL/TLS and DNS health scores are relatively strong, mixed content issues and missing DNSSEC reduce overall trustworthiness. Network exposure of services like SSH presents an additional attack surface. Addressing these issues will significantly enhance the security posture and reduce business risks related to compliance, data breaches, and service disruption.

I

INFIBEAM AVENUES

ccavenue.sa

65

The website demonstrates a concerning overall security posture with multiple high and medium severity issues, particularly in security headers, GDPR compliance, and NIS2 regulatory readiness. Critical vulnerabilities are absent, which is positive, but the absence of essential security headers and incomplete GDPR cookie management expose the business to data breaches and regulatory fines. The lack of documented security policies, incident response procedures, and security contact points under NIS2 requirements significantly increases operational risk and potential downtime. While email security and DNS health are relatively strong, foundational SSL/TLS configurations and network exposure issues require attention. Addressing these gaps will reduce legal, reputational, and operational risks. Immediate remediation is recommended to safeguard customer data, ensure regulatory compliance, and maintain trust. This will support sustainable business growth and reduce the likelihood of cyber incidents impacting business continuity.

N

National Payments Corporation of India

upichalega.com

62

The website's overall security posture is concerning, with multiple critical and high-severity issues that expose the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. Key deficiencies include the absence of core email authentication protocols, lack of a documented information security framework, and missing critical security headers, which collectively weaken both technical defenses and compliance standing. GDPR compliance gaps, such as missing cookie policies and consent mechanisms, increase the risk of regulatory penalties and customer trust erosion. While network security and DNS health show relative strength, foundational controls like SSL/TLS key management and incident response procedures are inadequate. Immediate remediation is needed to protect sensitive data, uphold legal requirements, and ensure business continuity. Addressing these issues will enhance customer confidence and reduce exposure to cyber threats. The current state suggests the need for a prioritized security improvement plan integrating policy, technical, and compliance measures.

C

CCAvenue

ccavenue.com

66

The website demonstrates a moderate to low overall security posture with no critical vulnerabilities but several high and medium risk issues that could expose the business to significant threats. Key deficiencies exist in foundational web security headers, GDPR compliance, and adherence to NIS2 regulations, indicating potential legal and operational risks. Missing security headers like Content-Security-Policy and X-Frame-Options increase vulnerability to common web attacks such as clickjacking and cross-site scripting. GDPR gaps, including absent cookie policies and consent mechanisms, expose the business to regulatory fines and reputational damage. The lack of documented security policies, incident response, and business continuity plans points to unpreparedness for cyber incidents, potentially leading to extended downtime or data breaches. SSL certificate expiration soon poses imminent risk of service disruption and loss of customer trust. While email security and network security are relatively strong, enhancements like enabling DNSSEC and securing exposed services are needed. Overall, urgent remediation is required to protect business operations, ensure regulatory compliance, and maintain customer confidence.

R

RBL Bank

rblbank.com

71

The website demonstrates a strong foundation in network and email security, with high scores in these areas indicating robust protection against common threats. However, critical gaps exist in compliance with GDPR and NIS2 regulations, reflected by multiple high-severity issues such as missing privacy and cookie policies, lack of incident response and security documentation, and absence of a formal information security framework. These deficiencies expose the business to regulatory fines, reputational damage, and operational risks in the event of security incidents. Additionally, weaknesses in SSL/TLS implementation and DNS configuration could undermine data confidentiality and integrity. While no critical vulnerabilities were found, the presence of numerous high-risk issues necessitates immediate attention to avoid compliance breaches and security incidents. Addressing these concerns will strengthen legal compliance, improve customer trust, and enhance overall resilience against cyber threats. Priority should be given to establishing comprehensive privacy policies, security governance, and incident handling processes. Renewing and upgrading SSL certificates and enabling DNSSEC will further solidify technical defenses.

R

RuPay

rupay.co.in

66

The website demonstrates a moderate overall security posture with no critical vulnerabilities but several high and medium-risk issues that pose significant compliance and operational risks. Key gaps are evident in GDPR compliance, including the absence of privacy and cookie policies, consent mechanisms, and third-party privacy assurances, exposing the business to legal and reputational risks. Additionally, the lack of a formal information security framework and incident response procedures indicates immature organizational security governance, increasing the risk of ineffective breach management. Weaknesses in SSL/TLS configuration and missing critical security headers reduce the site’s defense against common web-based attacks. While network security and email authentication score well, DNS and header configurations require improvement to prevent data interception and spoofing. Addressing these issues will strengthen trust with customers, ensure regulatory compliance, and reduce exposure to cyber threats. Immediate focus on compliance and security policy documentation is essential to safeguard business continuity and avoid penalties.

The website's security posture is concerning due to multiple critical vulnerabilities that threaten availability, authenticity, and regulatory compliance. The most severe issues involve DNS health failures, including DNS resolution failure, absence of name servers, and domain registration problems, which can lead to complete website downtime and loss of user trust. Email security is also critically weak, lacking proper authentication mechanisms like DKIM and SPF, increasing the risk of phishing and email spoofing attacks. Medium-level deficiencies in security headers, GDPR and NIS2 compliance, and network security scans indicate gaps that could be exploited or result in regulatory penalties. While SSL/TLS is well-configured, this alone cannot mitigate the underlying infrastructure and authentication weaknesses. The absence of DNSSEC and CAA records further exposes the domain to DNS attacks and misuse of SSL certificates. Immediate attention is needed to restore DNS functionality, configure email authentication, and address compliance failures to protect the business’s brand reputation and operational continuity. Overall, the current state poses a significant risk to both security and compliance, requiring prioritized remediation efforts.

C

Cleartrip

cleartrip.com

70

The website demonstrates a strong foundation in core network, email, and SSL/TLS security, evidenced by high scores in these areas. However, significant gaps exist in web security headers, GDPR compliance, and adherence to NIS2 security standards, exposing the business to regulatory risks and potential reputational damage. Critical privacy policies and user consent mechanisms are missing, which can lead to non-compliance fines and loss of customer trust. The absence of an incident response plan and security policy documentation further increases operational risk in the event of a security breach. Additionally, missing key HTTP security headers weakens defenses against common web-based attacks. While DNS security is generally healthy, the lack of DNSSEC implementation leaves potential vulnerabilities unmitigated. Overall, the website requires urgent attention to governance, compliance, and web security controls to minimize legal, financial, and operational risks.

A

Amazon.com, Inc.

amazonpay.in

70

The website demonstrates a generally strong technical security foundation with excellent SSL/TLS and network security postures and solid email security and DNS health scores. However, significant gaps exist in compliance with GDPR and NIS2 regulatory frameworks, posing substantial legal, reputational, and operational risks. Critical deficiencies include the absence of key privacy policies, cookie consent mechanisms, and comprehensive security governance documentation such as incident response and security policies. Security header configurations are suboptimal but represent a lower risk compared to compliance failures. The lack of vulnerability disclosure policies and business continuity planning further exposes the organization to prolonged downtime and unaddressed security incidents. Addressing these compliance and governance issues is essential to mitigate regulatory penalties, build customer trust, and ensure resilience against cyber threats. Immediate remediation will strengthen the overall security posture and align the organization with industry best practices and legal requirements.

N

NDTV Shopping

ndtvshopping.com

69

The website demonstrates a moderate overall security posture with strong network security and solid SSL/TLS and DNS configurations. However, critical vulnerabilities exist in email authentication and compliance with GDPR and NIS2 regulations, exposing the business to potential data breaches, regulatory fines, and reputational damage. Missing key security headers, particularly the Content-Security-Policy, increase the risk of cross-site scripting attacks. The absence of a cookie policy and consent mechanism violates GDPR requirements, risking legal penalties and loss of customer trust. Lack of documented security policies, incident response plans, and vulnerability disclosure processes under NIS2 indicates immature security governance and preparedness. Email systems lack proper authentication, making phishing and spoofing attacks more likely. Immediate remediation efforts are necessary to protect sensitive data, maintain regulatory compliance, and uphold customer confidence. Overall, while foundational security controls are solid, critical gaps must be addressed promptly to reduce risk exposure and ensure business continuity.

N

NDTV Game

ndtvgames.com

57

The website's overall security posture reveals significant gaps, particularly in foundational security headers, GDPR compliance, and incident management frameworks. Critical weaknesses in email authentication and the absence of privacy and cookie policies expose the business to phishing risks and regulatory penalties. While network security and SSL/TLS configurations are relatively strong, the lack of a formal information security framework and incident response procedures increases vulnerability to breaches and operational disruptions. GDPR compliance issues, including missing consent mechanisms and third-party privacy policies, pose substantial legal and reputational risks. The absence of key security headers such as Content-Security-Policy and X-Frame-Options leaves the site susceptible to cross-site scripting and clickjacking attacks. Overall, the business must urgently address these high and critical issues to protect customer data, maintain trust, and meet regulatory requirements. Improvements in email security and security governance will significantly enhance the company's risk posture and resilience.

The website exhibits significant security weaknesses, with critical and high-severity issues spanning several key domains including email security, GDPR compliance, and core security headers. The absence of essential email authentication mechanisms poses a critical risk of phishing and domain spoofing, potentially damaging brand reputation and customer trust. Compliance gaps related to GDPR, such as missing privacy and cookie policies and lack of consent mechanisms, expose the business to regulatory penalties and legal liabilities. The lack of a documented information security framework, incident response procedures, and business continuity planning indicates immature organizational security governance, increasing the risk of prolonged downtime or uncontrolled data breaches. Weak security headers and SSL/TLS configurations undermine defenses against common web-based attacks and data interception. Although network security and DNS health show relatively better scores, critical vulnerabilities in foundational security controls require urgent remediation. Overall, these findings suggest the website is vulnerable to exploitation, compliance failures, and reputational harm, necessitating immediate, prioritized improvements.

The website exhibits several significant security weaknesses that could expose the business to data breaches, compliance violations, and reputational damage. Critical issues include an invalid SSL certificate and lack of email authentication, which undermine secure communications and increase phishing risks. The presence of a high-risk FTP service and exposed SSH service further increases the attack surface with potential unauthorized access vectors. Medium-level issues such as missing security headers, failed GDPR and NIS2 compliance checks, and absence of DNSSEC reduce the overall resilience against common web and regulatory threats. Although some modules score moderately well, the critical and high-risk vulnerabilities require immediate remediation to protect customer data and maintain trust. Failure to address these could result in regulatory penalties and loss of customer confidence. Overall, while the website is operational, its current security posture is inadequate to defend against advanced cyber threats or meet compliance standards. Immediate focus on fixing critical vulnerabilities will provide the best risk reduction and business continuity assurance.

R

RaiseDonors

raisedonors.com

60

The website demonstrates a concerning security posture with no critical issues but multiple high and medium severity vulnerabilities across key areas. Significant gaps in security headers and SSL/TLS configurations expose the site to common web attacks such as clickjacking, content injection, and man-in-the-middle risks. Compliance with GDPR is weak, notably lacking cookie policies and consent mechanisms, which can lead to legal and reputational risks. The absence of documented information security frameworks, incident response procedures, and security policies under NIS2 regulation further increases organizational risk and potential regulatory penalties. While email security and network security show relatively strong postures, foundational controls in web security, privacy compliance, and incident management require urgent attention. Overall, the current state could negatively impact customer trust, lead to data breaches, and incur regulatory fines. Immediate remediation is essential to strengthen defenses and ensure compliance with legal and industry standards.

C

CoStar Group

costargroup.com

72

The website demonstrates a solid foundation in core security areas such as email security, SSL/TLS, and network security, each scoring a perfect 100. However, significant gaps exist in compliance and governance frameworks, particularly around GDPR and NIS2 regulations, with both modules scoring only 25 out of 100. The absence of fundamental privacy documentation and consent mechanisms exposes the business to regulatory penalties and reputational damage. Additionally, missing security policies, incident response plans, and vulnerability disclosure programs highlight a lack of mature security governance. Weaknesses in HTTP security headers, though lower in severity, still present opportunities for attackers to exploit browser-based vulnerabilities. DNS security is moderately strong but can be improved by enabling DNSSEC and configuring CAA records. Overall, the organization must urgently focus on compliance and governance controls to mitigate legal risks and improve customer trust, while continuing to maintain its current technical security strengths.

E

EarthX

earthxtv.com

64

The website demonstrates a moderate to poor overall security posture, with critical gaps in key areas such as security headers, GDPR compliance, and adherence to NIS2 requirements. No critical vulnerabilities were found, but several high-severity issues pose significant risks including missing essential HTTP security headers and lack of foundational security policies and procedures. GDPR compliance is insufficient, risking regulatory penalties and damaging customer trust due to missing cookie consent and incomplete privacy practices. The absence of incident response and business continuity plans further increases operational risk. Email security and network security are relatively strong, but SSL/TLS implementation weaknesses and DNS configuration gaps expose the site to man-in-the-middle and spoofing attacks. Immediate attention to security headers and policy frameworks is essential to reduce exposure to common web attacks and regulatory non-compliance. Overall, the organization should prioritize governance, technical controls, and compliance to safeguard data and maintain business continuity.

E

EarthX

earthxmedia.com

64

The website exhibits a concerning security posture with multiple high and medium risk issues, particularly in security headers, GDPR compliance, and adherence to NIS2 regulatory requirements. Critical headers such as Strict-Transport-Security, X-Frame-Options, and Content-Security-Policy are missing, exposing the site to common web-based attacks like clickjacking and content injection. GDPR compliance gaps, including the absence of a cookie consent banner and incomplete privacy policies, present legal and reputational risks. The lack of documented information security frameworks, incident response procedures, and business continuity planning reflects immature security governance. SSL/TLS weaknesses, including weak key lengths and certificates nearing expiration, threaten encrypted communications. While network security posture and DNS health are relatively strong, key DNS security features like DNSSEC are absent. Overall, immediate improvement is needed in governance, compliance, and foundational security controls to reduce risk and ensure regulatory alignment.

V

Virtuous Software

virtuous.org

69

The website demonstrates a moderate overall security posture with no critical vulnerabilities detected but multiple high and medium priority issues that expose it to significant risk. Key weaknesses lie in missing essential security headers, lack of GDPR compliance measures, and inadequate implementation of NIS2 security frameworks, which collectively threaten data protection and regulatory adherence. SSL/TLS configurations need urgent improvement due to weak key lengths and impending certificate expirations, increasing susceptibility to interception. DNS and network security are relatively strong, and email security is excellent, providing a solid foundation in those areas. However, the absence of incident response procedures and security policy documentation highlights a lack of preparedness for security incidents. The missing cookie policy and consent mechanisms further expose the business to legal and reputational risks under data privacy regulations. Addressing these issues promptly will strengthen the website’s defenses, ensure compliance, and safeguard customer trust.

I

Institutional Real Estate, Inc.

irei.com

64

The website exhibits a concerning security posture with no critical issues but multiple high and medium severity vulnerabilities. Key deficiencies exist in security headers, exposing the site to clickjacking, XSS, and content injection attacks. GDPR compliance is weak, lacking cookie policies and consent mechanisms, which risks regulatory penalties and erodes customer trust. The absence of a formal information security framework, incident response, and security policies under NIS2 regulations exposes the business to operational risks and potential regulatory non-compliance. SSL/TLS configurations are suboptimal, featuring weak encryption and expiring certificates, increasing susceptibility to interception. DNS security is moderate but can be improved by enabling DNSSEC and configuring CAA records. While email and network security are strong, the overall posture demands urgent remediation to protect business assets, ensure compliance, and maintain customer confidence.

R

RFTB Digital Agency

rftb.agency

68

The website demonstrates a moderate security posture with no critical vulnerabilities detected but multiple high and medium-risk issues that could impact regulatory compliance and operational security. Notably, major gaps in GDPR compliance, including lack of privacy and cookie policies as well as absence of a consent mechanism, expose the business to legal and reputational risks. The absence of a formal information security framework, security policies, incident response, and business continuity plans significantly weakens the organization's resilience against cyber threats and regulatory mandates like NIS2. Technical security controls such as security headers and network services also show deficiencies, including missing Content-Security-Policy headers and exposure of high-risk services like FTP. SSL/TLS and email security are relatively strong, mitigating some risk. Overall, the company should urgently address compliance and governance gaps while strengthening security controls to reduce exposure and support sustainable business operations. Failure to act could result in regulatory penalties, data breaches, and damage to customer trust.

V

VOMO Software

vomo.org

69

The website demonstrates a moderate overall security posture with no critical issues but several high and medium-risk vulnerabilities, particularly in security headers, GDPR compliance, and NIS2 regulatory adherence. Missing essential security headers like Content-Security-Policy and X-Frame-Options expose the site to clickjacking and content injection attacks, increasing the risk of data breaches and reputational damage. GDPR compliance gaps, including absence of a cookie policy and consent banner, expose the business to regulatory fines and legal challenges. The lack of a formal information security framework, incident response procedures, and security policies under NIS2 regulations significantly weakens organizational resilience against cyber threats and potential operational disruptions. SSL/TLS weaknesses, such as weak key lengths and an expiring certificate, threaten data confidentiality and trust. However, email and network security measures are robust, minimizing risks from those vectors. Immediate remediation in compliance and security controls will reduce regulatory exposure, protect customer data, and enhance stakeholder confidence.

E

EarthX

earthx.org

65

The website demonstrates a generally moderate security posture with no critical issues but several high and medium risks that could impact business continuity, customer trust, and regulatory compliance. Key deficiencies include missing critical security headers and lack of foundational security policies such as incident response and business continuity planning. GDPR compliance gaps like the absence of a cookie consent banner and incomplete privacy documentation pose legal and reputational risks. The NIS2 framework adoption is notably weak, indicating insufficient organizational security governance and readiness. Email security and SSL/TLS configurations are adequate but require improvements to prevent phishing and data interception. DNS and network security show solid implementation, which reduces exposure to certain attack vectors. Overall, immediate attention to security headers, policy frameworks, and regulatory compliance is vital to strengthen defenses and maintain stakeholder confidence.

O

Old Parkland

oldparkland.com

71

The website demonstrates a generally strong technical security foundation, with excellent scores in email security, SSL/TLS, DNS health, and network security. However, significant gaps exist in governance and compliance areas, particularly relating to GDPR and NIS2 regulatory requirements. The absence of key privacy policies, cookie consent mechanisms, and documented information security frameworks exposes the business to legal risks, regulatory penalties, and reputational damage. Missing security headers and incomplete incident response and business continuity plans increase vulnerability to cyberattacks and operational disruptions. Immediate remediation in compliance documentation and security governance is critical to align with legal obligations and protect customer trust. Proactive management of expiring SSL certificates and DNSSEC implementation will strengthen overall resilience. Addressing these issues will reduce regulatory exposure and enhance the organization's security maturity, supporting sustainable business growth.

C

Crow Holdings

crowholdings.com

71

The website demonstrates a moderate security posture with no critical issues detected but multiple high and medium-risk vulnerabilities that require urgent attention. Key areas of concern include missing security headers, significant gaps in GDPR compliance, and inadequate implementation of the NIS2 directive requirements. The absence of essential security policies, incident response procedures, and security contact information poses substantial operational and regulatory risks. SSL/TLS weaknesses and impending certificate expiry further elevate the risk of data interception. While email security and network security are strong points, foundational improvements in data protection and governance are urgently needed. Addressing these issues will reduce legal exposure, improve customer trust, and strengthen overall cyber resilience. Immediate remediation efforts should focus on compliance frameworks and critical security controls to align with industry best practices and regulatory mandates.

T

Treasury Intelligence Solutions GmbH

tispayments.com

72

The website demonstrates a solid network security posture and strong email security but reveals significant weaknesses in regulatory compliance and foundational security governance. High-impact issues center around GDPR non-compliance, including absence of cookie policies and consent mechanisms, risking legal penalties and reputational damage. The NIS2-related findings indicate a lack of critical policies and incident response procedures, exposing the organization to operational risks and potential regulatory sanctions. SSL/TLS configurations also present vulnerabilities with weak key lengths and impending certificate expiration that could undermine data confidentiality and user trust. Medium-level header and DNS security gaps further expose the site to exploitation opportunities. Overall, the site needs urgent attention to compliance frameworks and security policy documentation to align with legal and industry standards. Addressing these areas will reduce legal risk, enhance customer trust, and strengthen cyber resilience.

C

Crow Holdings

tcr.com

72

The website's overall security posture shows no critical vulnerabilities but reveals significant gaps in compliance and security best practices, especially in GDPR adherence and NIS2 regulatory requirements. While network and email security are strong, key deficiencies such as missing security headers, weak SSL configurations, and absent incident response and security policies pose material risks. The lack of a Content-Security-Policy header and weak SSL key length expose the business to potential data breaches and man-in-the-middle attacks. GDPR non-compliance, including missing cookie policies and consent mechanisms, exposes the organization to regulatory fines and reputational damage. The absence of an information security framework and incident response procedures under NIS2 indicates immature cybersecurity governance. Addressing these issues will improve legal compliance, reduce risk exposure, and strengthen customer trust. Immediate remediation will also help avoid costly disruptions and penalties while supporting sustainable security management practices.