Security report for fivth.com

12 findings rated critical or high. Fix these first.

1. Email security

   See the evidence for Email security

   SPF, DKIM and DMARC stop others sending email that looks like it comes from your domain, a common route to phishing and invoice fraud.

   • Critical

     No email authentication configured

     Domain is vulnerable to email spoofing

     What to do: Implement SPF, DKIM, and DMARC immediately

     References

     • CAPEC-98
     • RFC 7208
     • RFC 6376
     • RFC 9989
     • NIS2 21(2)(e)
     • IR 2024/2690 6.7.2(k): Implementing Regulation (EU) 2024/2690, Annex point 6.7.2(k): Network security
     • NIST SP 800-177r1
     • +4 more

2. Security headers

   See the evidence for Security headers

   Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

   • High

     Missing X-Frame-Options header

     Prevents clickjacking attacks

     What to do: Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN"

     References

     • CWE-1021
     • OWASP A06:2025
     • CAPEC-103
     • ASVS V3.4.6
     • OWASP Secure Headers: OWASP Secure Headers Project recommends X-Frame-Options: deny
     • RFC 7034
     • +3 more
   • High

     Missing Content-Security-Policy header

     Controls resources the browser is allowed to load

     What to do: Implement a Content-Security-Policy appropriate for your application

     References

     • ASVS V3.4.3
     • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

3. GDPR compliance

   See the evidence for GDPR compliance

   These are the privacy signals visitors and data protection authorities look for under GDPR.

   • High

     No Privacy Policy found

     GDPR requires a clear and accessible privacy policy

     What to do: Add a comprehensive privacy policy page and link to it prominently

     References

     • GDPR Art. 12
     • GDPR Art. 13
     • NIST PT-5: NIST SP 800-53 Rev. 5 PT-5: Privacy Notice
   • High

     No Cookie Policy found

     GDPR requires clear information about cookie usage

     What to do: Add a dedicated cookie policy explaining cookie usage and purposes

     References

     • ePrivacy Art. 5(3)
   • High

     No Cookie Consent Banner found

     GDPR requires explicit consent for non-essential cookies

     What to do: Implement a cookie consent banner that appears on first visit

     References

     • GDPR Art. 7
     • ePrivacy Art. 5(3)
     • NIST PT-4: NIST SP 800-53 Rev. 5 PT-4: Consent
   • High

     Third-party services without privacy policy

     Detected services: Facebook, LinkedIn, YouTube

     What to do: Document all third-party data sharing in your privacy policy

     References

     • GDPR Art. 13(1)(e)

4. NIS2 compliance

   See the evidence for NIS2 compliance

   NIS2 expects organisations in scope to show basic security hygiene. These public signals are what an auditor or customer sees first.

   • High

     No information security framework found

     NIS2 requires documented cybersecurity and information security measures

     What to do: Implement and document information security policies and procedures

     References

     • NIS2 21(2)(a)
     • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
     • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
   • High

     No security policy documentation found

     NIS2 requires documented cybersecurity governance and risk management

     What to do: Create and publish cybersecurity policy and framework documentation

     References

     • NIS2 21(2)(a)
     • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
     • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
   • High

     No incident response procedures found

     NIS2 requires documented incident response and business continuity plans

     What to do: Implement and document incident response and business continuity procedures

     References

     • NIS2 21(2)(b)
     • IR 2024/2690 3.1: Implementing Regulation (EU) 2024/2690, Annex point 3.1: Incident handling policy
     • NIST IR-8: NIST SP 800-53 Rev. 5 IR-8: Incident Response Plan
   • High

     No security contact information

     NIS2 requires clear incident reporting channels

     What to do: Add security contact information (e.g., security@domain.com)

     References

     • RFC 9116 §2.5.3
     • NIS2 21(2)(b)
     • IR 2024/2690 3.3: Implementing Regulation (EU) 2024/2690, Annex point 3.3: Event reporting

5. SSL/TLS

   See the evidence for SSL/TLS

   TLS encrypts the connection and proves the site is really yours. Weak or expiring certificates trigger browser warnings and put traffic at risk.

   • High

     Weak Protocols Supported

     Server supports weak protocols: TLSv1.1

     What to do: Disable TLS 1.0, TLS 1.1, and all SSL versions

     References

     • CWE-327
     • OWASP A04:2025
     • ASVS V12.1.1
     • RFC 8996
     • RFC 7568
     • Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: tls_versions TLSv1.2, TLSv1.3
     • NIS2 21(2)(h)
     • IR 2024/2690 9.2(b): Implementing Regulation (EU) 2024/2690, Annex point 9.2(b): Cryptography
     • NIST SC-8(1): NIST SP 800-53 Rev. 5 SC-8(1): Cryptographic Protection
     • +6 more