Skip to main content

Security report for heart.org

American Heart Association · Healthcare · United States

Security score

No score

The scan could not complete, so no score was produced. Try a rescan.

The American Heart Association (AHA) is a well-established non-profit organization dedicated to improving cardiovascular health and reducing deaths from heart disease and stroke. The website serves as a comprehensive resource for the general public, healthcare professionals, and donors, offering educational content, CPR training, advocacy information, and fundraising opportunities. The AHA maintains a strong market position as a leading U.S. non-profit in cardiovascular health, supported by extensive scientific research funding and professional memberships. Technically, the website is built on the Sitecore CMS platform and leverages modern technologies such as Google Tag Manager, Optimizely for experimentation, and Coveo for search functionality. The site demonstrates good performance, excellent mobile optimization, and accessibility features, providing a professional and user-friendly experience. From a security perspective, the site enforces HTTPS, employs security headers, and secures forms with CSRF tokens. While explicit security policies and incident response information are not published, the overall security posture is strong with no visible vulnerabilities. Privacy compliance is well addressed with clear privacy and cookie policies, including GDPR considerations. Overall, the website is trustworthy, professionally maintained, and aligned with the organization's mission. The lack of WHOIS data is mitigated by strong content and technical indicators of legitimacy. Strategic recommendations include publishing detailed security policies, vulnerability disclosure information, and data protection officer contacts to further enhance trust and compliance.

Scanned

This scan of heart.org failed before its checks completed, so it has no score and the results below are incomplete.

NIS2 and GDPR posture

NIS2 outside view
Not assessed
GDPR outside view
Not assessed

Both readouts depend on the site's pages, which could not be loaded in this scan.

Priority findings

The scan did not complete, so there are no findings to show. A rescan usually gets through if the site was briefly unreachable.

Keep watching heart.org

This scan could not reach the site. Monitoring re-runs every check daily and fills in the results once the site responds to the scanner.

Daily monitoring

€25per month

  • TLS certificates and expiry
  • DNS records
  • SPF, DKIM and DMARC
  • Security headers
  • GDPR and NIS2 posture
  • Exposed services
  • Third-party trackers
  • Security score drift

Email alerts on material changes and an exportable JSON history of every change.

Billed monthly to your card. Cancel anytime. See sample alerts.

Prices incl. 21% VAT. Secure checkout by Mollie; sold by SEQ SIA, Latvia.

Results by check

Each check with its score, findings and the evidence it collected.

Technical appendix

Business context, site observations and technical notes gathered during the scan, and the standards behind each reference.

Business context

Business profile

The American Heart Association operates as a large non-profit entity focused on healthcare education, advocacy, and research funding. Its business model relies on donations, memberships, and fundraising events. The organization targets a broad audience including patients, caregivers, healthcare professionals, and donors. The website reflects a mature digital presence with integrated social media channels and partner sites. The AHA's competitive advantage lies in its authoritative content, extensive research funding, and nationwide community engagement. Growth indicators include active volunteer programs, professional memberships, and ongoing advocacy initiatives. The partnership ecosystem includes specialized subdomains and related health organizations, enhancing its reach and impact.

Security posture

The website exhibits a mature security posture with HTTPS enforced and multiple security headers implemented. Forms are protected with anti-CSRF tokens, and no sensitive data is exposed in the HTML. However, the absence of a publicly available security policy, incident response plan, or vulnerability disclosure program represents a compliance gap. There is no visible security.txt file or dedicated contact for security incidents. Privacy policies are comprehensive and GDPR compliant, indicating good data protection practices. Overall, the site is secure but could improve transparency and readiness by publishing formal security governance documents and incident response contacts.

Recommendations

  1. Publish a dedicated security policy and incident response plan on the website.
  2. Implement and publish a vulnerability disclosure program or security.txt file.
  3. Provide contact information for a Data Protection Officer or security team.
  4. Enhance transparency around data retention and privacy compliance measures.
  5. Regularly audit third-party scripts and tracking tools to minimize privacy risks.

Contact details published on the site

Addresses
Legal name
American Heart Association
Site observations

Automated reading of the public site. Ratings are indicative.

Business

Company
American Heart Association
Description
The American Heart Association is a non-profit organization dedicated to reducing death caused by heart disease and stroke. It provides information on cardiovascular conditions, ECC and CPR training, donation opportunities, and resources for healthcare professionals, caregivers, and educators.
Key services
Health education and awareness, CPR and ECC training, Fundraising and donation programs, Professional memberships and resources, Advocacy and policy research
Content quality
excellent
Branding
consistent

Technology

Stack
Google Tag Manager, Optimizely, Fundraise Up, Coveo Search, Bootstrap Icons, Google Fonts (Montserrat)
Frameworks
Bootstrap
Performance
moderate
Mobile
excellent
Accessibility
good
SEO
good

Security

Observed score
90/100
Good practices seen
  • HTTPS enforced
  • Secure forms with CSRF tokens
  • No exposed sensitive data in HTML
  • Use of security headers

Analytics and tracking

Services
Google Tag Manager
Tracking level
moderate
Privacy practices
good

Advertising

Tracking pixels
Optimizely
Marketing tools
Fundraise Up
Transparency
good

Site quality

Design
excellent
User experience
excellent
Content relevance
excellent
Navigation
excellent
Professionalism
excellent
Trustworthiness
high

Key observations

  1. Website is fully accessible with no blocking or WAF challenges.
  2. Content is comprehensive, professionally presented, and focused on cardiovascular health and education.
  3. Strong presence of privacy and terms policies with clear links.
  4. Multiple forms for newsletter sign-up and donations with secure implementations.
  5. Use of modern technologies and frameworks including Sitecore CMS, Google Tag Manager, and Optimizely.
  6. Social media presence across major platforms is well integrated.
  7. No suspicious or malicious content detected.
  8. WHOIS data unavailable, likely due to privacy protection, but website trustworthiness remains high.
Technical notes

Notes

The website is built on the Sitecore CMS platform, utilizing modern front-end technologies including Bootstrap for responsive design and Google Fonts for typography. It integrates advanced search capabilities via Coveo and uses Optimizely for A/B testing and personalization. Analytics are managed through Google Tag Manager. The site demonstrates good mobile optimization and accessibility compliance. Performance is moderate, likely influenced by multiple third-party scripts and rich media content. Technical risks include reliance on external services for fundraising and tracking, which should be regularly reviewed for security and privacy compliance. Opportunities exist to streamline scripts and enhance caching strategies to improve load times.
Standards and sources

Reference chips under each finding point to the standard, regulation or specification the finding relates to. They are taken from the official datasets below and mapped conservatively: a finding with no defensible link shows none. NIS2 and GDPR references mark where a finding is relevant evidence, not a compliance verdict. Implementing Regulation (EU) 2024/2690 binds digital infrastructure and digital service providers; for other entities it is the most detailed public reading of the Article 21 measures. WCAG, EN 301 549, European Accessibility Act and Web Accessibility Directive references name the requirement an automated accessibility rule relates to; they are not a conformance verdict.

Retrieved 2026-10-25

Earlier scans of this domain

  1. 76/100Low25 findingsView report
Reviews of this site

Share your experience with heart.org. Every review is verified by email and published after moderation.

Overall rating
Select a rating
4000 characters remaining

We’ll email you to confirm your review and keep your details private.

Community rating

No published reviews yet. Be the first to review heart.org.

Feedback on this report

Rate this report, add an optional comment, and tell us if you want a security specialist to follow up.

Overall report quality
Select a rating
2000 characters remaining

We only use your feedback to improve Guard reports. Contact details are never shared.