Security report for flowyak.com

11 findings rated critical or high. Fix these first.

1. Security headers

   See the evidence for Security headers

   Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

   • High

     Missing X-Frame-Options header

     Prevents clickjacking attacks

     What to do: Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN"

     References

     • CWE-1021
     • OWASP A06:2025
     • CAPEC-103
     • ASVS V3.4.6
     • OWASP Secure Headers: OWASP Secure Headers Project recommends X-Frame-Options: deny
     • RFC 7034
     • +3 more
   • High

     Missing Content-Security-Policy header

     Controls resources the browser is allowed to load

     What to do: Implement a Content-Security-Policy appropriate for your application

     References

     • ASVS V3.4.3
     • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

2. GDPR compliance

   See the evidence for GDPR compliance

   These are the privacy signals visitors and data protection authorities look for under GDPR.

   • High

     No Privacy Policy found

     GDPR requires a clear and accessible privacy policy

     What to do: Add a comprehensive privacy policy page and link to it prominently

     References

     • GDPR Art. 12
     • GDPR Art. 13
     • NIST PT-5: NIST SP 800-53 Rev. 5 PT-5: Privacy Notice
   • High

     No Cookie Policy found

     GDPR requires clear information about cookie usage

     What to do: Add a dedicated cookie policy explaining cookie usage and purposes

     References

     • ePrivacy Art. 5(3)
   • High

     No Cookie Consent Banner found

     GDPR requires explicit consent for non-essential cookies

     What to do: Implement a cookie consent banner that appears on first visit

     References

     • GDPR Art. 7
     • ePrivacy Art. 5(3)
     • NIST PT-4: NIST SP 800-53 Rev. 5 PT-4: Consent

3. NIS2 compliance

   See the evidence for NIS2 compliance

   NIS2 expects organisations in scope to show basic security hygiene. These public signals are what an auditor or customer sees first.

   • High

     No information security framework found

     NIS2 requires documented cybersecurity and information security measures

     What to do: Implement and document information security policies and procedures

     References

     • NIS2 21(2)(a)
     • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
     • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
   • High

     No security policy documentation found

     NIS2 requires documented cybersecurity governance and risk management

     What to do: Create and publish cybersecurity policy and framework documentation

     References

     • NIS2 21(2)(a)
     • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
     • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
   • High

     No incident response procedures found

     NIS2 requires documented incident response and business continuity plans

     What to do: Implement and document incident response and business continuity procedures

     References

     • NIS2 21(2)(b)
     • IR 2024/2690 3.1: Implementing Regulation (EU) 2024/2690, Annex point 3.1: Incident handling policy
     • NIST IR-8: NIST SP 800-53 Rev. 5 IR-8: Incident Response Plan
   • High

     No security contact information

     NIS2 requires clear incident reporting channels

     What to do: Add security contact information (e.g., security@domain.com)

     References

     • RFC 9116 §2.5.3
     • NIS2 21(2)(b)
     • IR 2024/2690 3.3: Implementing Regulation (EU) 2024/2690, Annex point 3.3: Event reporting
   • High

     Critical sector without clear security compliance

     Detected sectors: energy, transport, digital

     What to do: Critical sectors require comprehensive NIS2 compliance program

     References

     • NIS2 21(1)

4. SSL/TLS

   See the evidence for SSL/TLS

   TLS encrypts the connection and proves the site is really yours. Weak or expiring certificates trigger browser warnings and put traffic at risk.

   • High

     Weak SSL Key Length

     SSL certificate uses 256-bit key, which is considered weak

     What to do: Use at least 2048-bit RSA or 256-bit ECC key

     References

     • CWE-326
     • OWASP A04:2025
     • Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: rsa_key_size 2048
     • NIS2 21(2)(h)
     • IR 2024/2690 9.2(b): Implementing Regulation (EU) 2024/2690, Annex point 9.2(b): Cryptography
     • NIST SC-13: NIST SP 800-53 Rev. 5 SC-13: Cryptographic Protection
     • +3 more