Security report for flutterci.com

12 findings rated critical or high. Fix these first.

1. Email security

   See the evidence for Email security

   SPF, DKIM and DMARC stop others sending email that looks like it comes from your domain, a common route to phishing and invoice fraud.

   • Critical

     No email authentication configured

     Domain is vulnerable to email spoofing

     What to do: Implement SPF, DKIM, and DMARC immediately

     References

     • CAPEC-98
     • RFC 7208
     • RFC 6376
     • RFC 9989
     • NIS2 21(2)(e)
     • IR 2024/2690 6.7.2(k): Implementing Regulation (EU) 2024/2690, Annex point 6.7.2(k): Network security
     • NIST SP 800-177r1
     • +4 more
   • High

     No SPF record found

     SPF helps prevent email spoofing

     What to do: Add SPF record: "v=spf1 include:_spf.yourmailprovider.com ~all"

     References

     • RFC 7208
     • NIS2 21(2)(e)
     • IR 2024/2690 6.7.2(k): Implementing Regulation (EU) 2024/2690, Annex point 6.7.2(k): Network security
     • NIST SP 800-177r1

2. Security headers

   See the evidence for Security headers

   Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

   • High

     Missing Strict-Transport-Security header

     Forces HTTPS connections

     What to do: Add "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload"

     References

     • CWE-319
     • OWASP A04:2025
     • ASVS V3.4.1
     • RFC 6797 §6.1.1
     • Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: hsts_min_age 63072000
     • NIS2 21(2)(h)
     • IR 2024/2690 9.2(a): Implementing Regulation (EU) 2024/2690, Annex point 9.2(a): Cryptography
     • NIST SC-8: NIST SP 800-53 Rev. 5 SC-8: Transmission Confidentiality and Integrity
     • +5 more
   • High

     Missing X-Frame-Options header

     Prevents clickjacking attacks

     What to do: Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN"

     References

     • CWE-1021
     • OWASP A06:2025
     • CAPEC-103
     • ASVS V3.4.6
     • OWASP Secure Headers: OWASP Secure Headers Project recommends X-Frame-Options: deny
     • RFC 7034
     • +3 more
   • High

     Missing Content-Security-Policy header

     Controls resources the browser is allowed to load

     What to do: Implement a Content-Security-Policy appropriate for your application

     References

     • ASVS V3.4.3
     • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

3. GDPR compliance

   See the evidence for GDPR compliance

   These are the privacy signals visitors and data protection authorities look for under GDPR.

   • High

     No Cookie Policy found

     GDPR requires clear information about cookie usage

     What to do: Add a dedicated cookie policy explaining cookie usage and purposes

     References

     • ePrivacy Art. 5(3)

4. NIS2 compliance

   See the evidence for NIS2 compliance

   NIS2 expects organisations in scope to show basic security hygiene. These public signals are what an auditor or customer sees first.

   • High

     No information security framework found

     NIS2 requires documented cybersecurity and information security measures

     What to do: Implement and document information security policies and procedures

     References

     • NIS2 21(2)(a)
     • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
     • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
   • High

     No security policy documentation found

     NIS2 requires documented cybersecurity governance and risk management

     What to do: Create and publish cybersecurity policy and framework documentation

     References

     • NIS2 21(2)(a)
     • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
     • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
   • High

     No incident response procedures found

     NIS2 requires documented incident response and business continuity plans

     What to do: Implement and document incident response and business continuity procedures

     References

     • NIS2 21(2)(b)
     • IR 2024/2690 3.1: Implementing Regulation (EU) 2024/2690, Annex point 3.1: Incident handling policy
     • NIST IR-8: NIST SP 800-53 Rev. 5 IR-8: Incident Response Plan
   • High

     No security contact information

     NIS2 requires clear incident reporting channels

     What to do: Add security contact information (e.g., security@domain.com)

     References

     • RFC 9116 §2.5.3
     • NIS2 21(2)(b)
     • IR 2024/2690 3.3: Implementing Regulation (EU) 2024/2690, Annex point 3.3: Event reporting
   • High

     Critical sector without clear security compliance

     Detected sectors: energy, transport, banking, digital

     What to do: Critical sectors require comprehensive NIS2 compliance program

     References

     • NIS2 21(1)

5. SSL/TLS

   See the evidence for SSL/TLS

   TLS encrypts the connection and proves the site is really yours. Weak or expiring certificates trigger browser warnings and put traffic at risk.

   • High

     Weak Protocols Supported

     Server supports weak protocols: TLSv1.1

     What to do: Disable TLS 1.0, TLS 1.1, and all SSL versions

     References

     • CWE-327
     • OWASP A04:2025
     • ASVS V12.1.1
     • RFC 8996
     • RFC 7568
     • Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: tls_versions TLSv1.2, TLSv1.3
     • NIS2 21(2)(h)
     • IR 2024/2690 9.2(b): Implementing Regulation (EU) 2024/2690, Annex point 9.2(b): Cryptography
     • NIST SC-8(1): NIST SP 800-53 Rev. 5 SC-8(1): Cryptographic Protection
     • +6 more