Security report for amateur-free-porn.com

8 findings rated critical or high. Fix these first.

1. Email security

   See the evidence for Email security

   SPF, DKIM and DMARC stop others sending email that looks like it comes from your domain, a common route to phishing and invoice fraud.

   • Critical

     No email authentication configured

     Domain is vulnerable to email spoofing

     What to do: Implement SPF, DKIM, and DMARC immediately

2. Security headers

   See the evidence for Security headers

   Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

   • High

     Missing Content-Security-Policy header

     Controls resources the browser is allowed to load

     What to do: Implement a Content-Security-Policy appropriate for your application

     References

     • ASVS V3.4.3
     • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

3. GDPR outside view

   See the evidence for GDPR outside view

   These are the privacy signals visitors and data protection authorities look for under GDPR.

   • High

     No Privacy Policy found

     GDPR requires a clear and accessible privacy policy

     What to do: Add a comprehensive privacy policy page and link to it prominently

     References

     • GDPR Art. 12
     • GDPR Art. 13
     • NIST PT-5: NIST SP 800-53 Rev. 5 PT-5: Privacy Notice
   • High

     No Cookie Policy found

     GDPR requires clear information about cookie usage

     What to do: Add a dedicated cookie policy explaining cookie usage and purposes

     References

     • ePrivacy Art. 5(3)
   • High

     No Cookie Consent Banner found

     GDPR requires explicit consent for non-essential cookies

     What to do: Implement a cookie consent banner that appears on first visit

     References

     • GDPR Art. 7
     • ePrivacy Art. 5(3)
     • NIST PT-4: NIST SP 800-53 Rev. 5 PT-4: Consent
   • High

     Third-party services without privacy policy

     Detected services: Google APIs

     What to do: Document all third-party data sharing in your privacy policy

     References

     • GDPR Art. 13(1)(e)

4. SSL/TLS

   See the evidence for SSL/TLS

   TLS encrypts the connection and proves the site is really yours. Weak or expiring certificates trigger browser warnings and put traffic at risk.

   • High

     Weak Protocols Supported

     Server supports weak protocols: TLSv1.1

     What to do: Disable TLS 1.0, TLS 1.1, and all SSL versions

     References

     • CWE-327
     • OWASP A04:2025
     • ASVS V12.1.1
     • RFC 8996
     • RFC 7568
     • Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: tls_versions TLSv1.2, TLSv1.3
     • NIS2 21(2)(h)
     • IR 2024/2690 9.2(b): Implementing Regulation (EU) 2024/2690, Annex point 9.2(b): Cryptography
     • NIST SC-8(1): NIST SP 800-53 Rev. 5 SC-8(1): Cryptographic Protection
     • +6 more

5. Network security

   See the evidence for Network security

   Services reachable from the internet are the first thing attackers probe. Anything open that does not need to be should be closed.

   • High

     High-Risk Service Exposed: FTP

     Port 21 (FTP) is publicly accessible - FTP - Often unencrypted file transfer

     What to do: Consider restricting access to FTP or implementing strong authentication

     References

     • NIS2 21(2)(e)
     • IR 2024/2690 6.7.2(f): Implementing Regulation (EU) 2024/2690, Annex point 6.7.2(f): Network security
     • NIST CM-7: NIST SP 800-53 Rev. 5 CM-7: Least Functionality
     • NIST SC-7: NIST SP 800-53 Rev. 5 SC-7: Boundary Protection