What is the security score of fnopo.it?

fnopo.it scored 45 out of 100 in Guard's security assessment. This indicates an elevated risk level with significant security gaps that should be addressed.

What does fnopo.it do?

fnopo.it operates in the Other sector based in N/a. The website is built using JavaScript. Guard's scan analyzes the website's security infrastructure and compliance posture.

Guard's security scan evaluates fnopo.it across multiple security dimensions including SSL certificate validity, security headers, DNS configuration, email authentication (SPF, DKIM, DMARC), and regulatory compliance (GDPR, NIS2). With a score of 45/100 classified as "Elevated Risk", review the detailed findings above to make an informed assessment about the website's trustworthiness.

Security report for fnopo.it

Q: Is fnopo.it safe to use?

Based on Guard's automated security analysis, fnopo.it received a security score of 45/100 and is classified as "Elevated Risk". The website fnopo.it currently serves a security challenge page that blocks direct access to its content, indicating the presence of a Web Application Firewall or similar security mechanism. The domain is registered since 2017 with DNSSEC enabled and is valid until late 2025, suggesting a legitimate

Other · N/a

High risk. 14 critical or high findings in GDPR compliance, Security headers and 2 other checks.

Security score

45/100

Risk levelHigh

The website fnopo.it currently serves a security challenge page that blocks direct access to its content, indicating the presence of a Web Application Firewall or similar security mechanism. The domain is registered since 2017 with DNSSEC enabled and is valid until late 2025, suggesting a legitimate registration. However, the website itself lacks accessible business information, contact details, or privacy and cookie policies, which limits the ability to assess its business operations or compliance posture. The presence of outdated CMS versions such as Joomla 1.5 and WordPress 2.5 raises significant security concerns due to known vulnerabilities in these legacy platforms. The site uses a security check powered by BitNinja.IO, which adds a layer of protection but also restricts content visibility for analysis.

Scanned

NIS2 and GDPR posture

NIS2 posture: 2/ 100 · Critical
GDPR posture: 25/ 100 · Critical
Checks completed: 7of 7

Indicative only: based on publicly visible signals, not a certification or legal assessment. NIS2 signals relate to Article 21 of Directive (EU) 2022/2555; GDPR signals to Articles 7, 12, 13 and 32 of Regulation (EU) 2016/679 and Article 5(3) of the ePrivacy Directive.

Priority findings

14 findings rated critical or high. Fix these first.

GDPR compliance
These are the privacy signals visitors and data protection authorities look for under GDPR.
- Critical
  EU business without adequate privacy measures
  EU businesses are subject to strict GDPR requirements
  What to do: Implement comprehensive GDPR compliance including privacy policy, cookie consent, and data protection measures
  References
  - GDPR Art. 13
  - ePrivacy Art. 5(3)
- High
  No Privacy Policy found
  GDPR requires a clear and accessible privacy policy
  What to do: Add a comprehensive privacy policy page and link to it prominently
  References
  - GDPR Art. 12
  - GDPR Art. 13
  - NIST PT-5: NIST SP 800-53 Rev. 5 PT-5: Privacy Notice
- High
  No Cookie Policy found
  GDPR requires clear information about cookie usage
  What to do: Add a dedicated cookie policy explaining cookie usage and purposes
  References
  - ePrivacy Art. 5(3)
- High
  No Cookie Consent Banner found
  GDPR requires explicit consent for non-essential cookies
  What to do: Implement a cookie consent banner that appears on first visit
  References
  - GDPR Art. 7
  - ePrivacy Art. 5(3)
  - NIST PT-4: NIST SP 800-53 Rev. 5 PT-4: Consent
Security headers
Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.
- High
  Missing Strict-Transport-Security header
  Forces HTTPS connections
  What to do: Add "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload"
  References
  - CWE-319
  - OWASP A04:2025
  - ASVS V3.4.1
  - RFC 6797 §6.1.1
  - Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: hsts_min_age 63072000
  - NIS2 21(2)(h)
  - IR 2024/2690 9.2(a): Implementing Regulation (EU) 2024/2690, Annex point 9.2(a): Cryptography
  - NIST SC-8: NIST SP 800-53 Rev. 5 SC-8: Transmission Confidentiality and Integrity
- High
  Missing X-Frame-Options header
  Prevents clickjacking attacks
  What to do: Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN"
  References
  - CWE-1021
  - OWASP A06:2025
  - CAPEC-103
  - ASVS V3.4.6
  - OWASP Secure Headers: OWASP Secure Headers Project recommends X-Frame-Options: deny
  - RFC 7034
- High
  Missing Content-Security-Policy header
  Controls resources the browser is allowed to load
  What to do: Implement a Content-Security-Policy appropriate for your application
  References
  - ASVS V3.4.3
  - OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…
NIS2 compliance
NIS2 expects organisations in scope to show basic security hygiene. These public signals are what an auditor or customer sees first.
- High
  No information security framework found
  NIS2 requires documented cybersecurity and information security measures
  What to do: Implement and document information security policies and procedures
  References
  - NIS2 21(2)(a)
  - IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
  - NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
- High
  No security policy documentation found
  NIS2 requires documented cybersecurity governance and risk management
  What to do: Create and publish cybersecurity policy and framework documentation
  References
  - NIS2 21(2)(a)
  - IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
  - NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
- High
  No incident response procedures found
  NIS2 requires documented incident response and business continuity plans
  What to do: Implement and document incident response and business continuity procedures
  References
  - NIS2 21(2)(b)
  - IR 2024/2690 3.1: Implementing Regulation (EU) 2024/2690, Annex point 3.1: Incident handling policy
  - NIST IR-8: NIST SP 800-53 Rev. 5 IR-8: Incident Response Plan
- High
  No security contact information
  NIS2 requires clear incident reporting channels
  What to do: Add security contact information (e.g., security@domain.com)
  References
  - RFC 9116 §2.5.3
  - NIS2 21(2)(b)
  - IR 2024/2690 3.3: Implementing Regulation (EU) 2024/2690, Annex point 3.3: Event reporting
- High
  Critical sector without clear security compliance
  Detected sectors: energy, transport, digital
  What to do: Critical sectors require comprehensive NIS2 compliance program
  References
  - NIS2 21(1)
SSL/TLS
TLS encrypts the connection and proves the site is really yours. Weak or expiring certificates trigger browser warnings and put traffic at risk.
- High
  Weak Protocols Supported
  Server supports weak protocols: TLSv1.1
  What to do: Disable TLS 1.0, TLS 1.1, and all SSL versions
  References
  - CWE-327
  - OWASP A04:2025
  - ASVS V12.1.1
  - RFC 8996
  - RFC 7568
  - Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: tls_versions TLSv1.2, TLSv1.3
  - NIS2 21(2)(h)
  - IR 2024/2690 9.2(b): Implementing Regulation (EU) 2024/2690, Annex point 9.2(b): Cryptography
  - NIST SC-8(1): NIST SP 800-53 Rev. 5 SC-8(1): Cryptographic Protection
- High
  Weak SSL Key Length
  SSL certificate uses 384-bit key, which is considered weak
  What to do: Use at least 2048-bit RSA or 256-bit ECC key
  References
  - CWE-326
  - OWASP A04:2025
  - Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: rsa_key_size 2048
  - NIS2 21(2)(h)
  - IR 2024/2690 9.2(b): Implementing Regulation (EU) 2024/2690, Annex point 9.2(b): Cryptography
  - NIST SC-13: NIST SP 800-53 Rev. 5 SC-13: Cryptographic Protection

Need hands-on remediation? Email guard@offseq.com

Keep watching fnopo.it

This scan found 36 issues across 7 checks. Monitoring re-runs those checks daily, emails you when something material changes and records each fix, so you can show progress.

Daily monitoring

Recommended

€25per month

TLS certificates and expiry
DNS records
SPF, DKIM and DMARC
Security headers
GDPR and NIS2 posture
Exposed services
Third-party trackers
Risk score drift

Email alerts on material changes and an exportable JSON history of every change.

Billed monthly. Cancel anytime. The full timeline opens with your unlock code.

Full report

€39.90one-time

The complete analysis as a PDF you can cite
Email delivery with an unlock code
Lifetime access to this report

Prices incl. 21% VAT. Payments by EveryPay; sold by SEQ SIA, Latvia.

Results by check

Each check with its score, findings and the evidence it collected.

Technical appendix

Business context, site observations and technical notes gathered during the scan, and the standards behind each reference.

Business context

Business profile

Due to the lack of accessible content and business information, it is not possible to determine the company's market position, business model, or target audience. The website metadata references Joomla and WordPress, indicating a possible technology or CMS-related focus, but no concrete business details are provided. No contact information or trust indicators such as certifications or testimonials are present. The domain age is consistent with a small or personal project rather than a large enterprise. No partnerships or subsidiaries are identified beyond a security service link to bitninja.io.

Security posture

The security posture is moderate due to the presence of DNSSEC and HTTPS, but significantly weakened by the use of outdated CMS versions known for vulnerabilities. The site lacks security headers and does not provide visible privacy or cookie policies, which are critical for GDPR compliance. The security challenge page indicates an active defense mechanism, but the overall security hygiene is poor due to legacy software and missing compliance documentation. No incident response or vulnerability disclosure information is available.

Recommendations

Upgrade all CMS platforms to the latest supported versions to eliminate known vulnerabilities.
Implement comprehensive privacy and cookie policies to ensure GDPR and other regulatory compliance.
Add clear contact information and business details to improve credibility and trust.
Enhance security headers and conduct regular security audits to strengthen the security posture.
Improve website content accessibility by configuring WAF rules to allow legitimate traffic and search engine indexing.

Site observations

Automated reading of the public site. Ratings are indicative.

Generic detected. Page is a security challenge page with automatic redirect and browser integrity checks, indicating WAF or security protection blocking direct content access. These observations may be incomplete. For a fuller analysis, contact guard@offseq.com.

Business

Description: Joomla!
Content quality: poor
Branding: inconsistent

Technology

Stack: JavaScript
Frameworks: Joomla! 1.5, WordPress 2.5
Performance: moderate
Mobile: basic
Accessibility: basic
SEO: poor

Security

Observed score

40/100

Good practices seen

DNSSEC enabled

Analytics and tracking

Tracking level: minimal
Privacy compliance: poor

Advertising

Transparency: poor

Site quality

Design: poor
User experience: poor
Content relevance: poor
Navigation: poor
Professionalism: poor
Trustworthiness: low

Key observations

Website content is blocked behind a security challenge page.
No privacy, cookie, or terms of service policies found.
No contact information or business details available.
Uses outdated CMS versions (Joomla 1.5 and WordPress 2.5) which are vulnerable.
Security check powered by BitNinja.IO is present.
Minimal SEO and accessibility features detected.
No analytics or tracking scripts found.
No advertising or marketing tools detected.
Domain is active and registered until late 2025 with DNSSEC enabled.

Technical notes

Notes

The website uses legacy CMS technologies (Joomla 1.5 and WordPress 2.5) which are outdated and pose security risks. The presence of JavaScript for browser integrity checks and automatic redirects suggests a security mechanism in place, likely a WAF or anti-bot service. The site lacks modern SEO and accessibility features, and no analytics or marketing tools are detected. Performance is moderate but limited by the security challenge page. The domain uses DNSSEC and HTTPS, indicating a baseline of secure DNS and transport layer security. Overall, the technical infrastructure requires modernization and improved security practices.

Standards and sources

Reference chips under each finding point to the standard, regulation or specification the finding relates to. They are taken from the official datasets below and mapped conservatively: a finding with no defensible link shows none. NIS2 and GDPR references mark where a finding is relevant evidence, not a compliance verdict. Implementing Regulation (EU) 2024/2690 binds digital infrastructure and digital service providers; for other entities it is the most detailed public reading of the Article 21 measures.

OWASP Top 10:2025 (opens in a new tab)2025 (membership per CWE 4.20) · CC BY-SA 4.0
OWASP ASVS (opens in a new tab)5.0.0 · CC BY-SA 4.0
OWASP Web Security Testing Guide (opens in a new tab)latest (checklist.json, master) · CC BY-SA 4.0
OWASP Secure Headers Project (opens in a new tab)2026-10-18 · Apache-2.0
Mozilla Server Side TLS (intermediate) (opens in a new tab)6.0 · MPL-2.0
NIST SP 800-53 Rev. 5 (OSCAL catalog) (opens in a new tab)5.2.0 · Public domain (US Government work)
Directive (EU) 2022/2555 (NIS2) (opens in a new tab)OJ L 333, 27.12.2022 · EUR-Lex reuse under Commission Decision 2011/833/EU (© European Union)
Commission Implementing Regulation (EU) 2024/2690 (opens in a new tab)OJ L, 18.10.2024 · EUR-Lex reuse under Commission Decision 2011/833/EU (© European Union)
Regulation (EU) 2016/679 (GDPR) (opens in a new tab)OJ L 119, 4.5.2016 · EUR-Lex reuse under Commission Decision 2011/833/EU (© European Union)
Directive 2002/58/EC (ePrivacy), consolidated (opens in a new tab)19.12.2009 · EUR-Lex reuse under Commission Decision 2011/833/EU (© European Union)
RFC Editor metadata (opens in a new tab)per-RFC (obsolete RFCs rejected) · IETF Trust Legal Provisions (metadata only)
NIST CSRC, W3C TR and IETF Datatracker (opens in a new tab)per document · Titles and links only

Retrieved 2026-10-24

Feedback on this report

Rate this report, add an optional comment, and tell us if you want a security specialist to follow up.

Priority findings

GDPR compliance

EU business without adequate privacy measures

No Privacy Policy found

No Cookie Policy found

No Cookie Consent Banner found

Security headers

Missing Strict-Transport-Security header

Missing X-Frame-Options header

Missing Content-Security-Policy header

NIS2 compliance

No information security framework found

No security policy documentation found

No incident response procedures found

No security contact information

Critical sector without clear security compliance

SSL/TLS

Weak Protocols Supported

Weak SSL Key Length

Keep watching fnopo.it

Daily monitoring

Full report

Results by check

Security headers, 7 findings, score 20/100

SSL/TLS, 6 findings, score 52/100

Email security, 5 findings, score 65/100

DNS health, 4 findings, score 70/100

Network security, 1 finding, score 100/100

GDPR compliance, 4 findings, score 25/100

NIS2 compliance, 9 findings, score 2/100