Skip to main content

Security report for thetw.com

興隨興展覽股份有限公司 · Manufacturing · Taiwan

Medium risk. 6 critical or high findings in Security headers, GDPR outside view and 1 other check.

Security score

63/100

Risk levelMedium

0–100, higher is better. How it is calculated

興隨興展覽股份有限公司是一家專注於國際大型及海外國際展覽代理與組展服務的公司，涵蓋安全器材、消費性電子、汽車零配件、專業機械、船舶及農機等多個領域。公司在美國CES及歐洲IFA Berlin等重要國際展覽中擔任主要組展單位，具備良好的市場地位和專業服務能力。網站內容豐富，針對企業及展覽參展商提供多元展覽服務與設計方案，並有深圳子公司支持中國大陸市場。技術基礎穩健，採用多種現代前端技術與分析工具，網站設計專業且具良好用戶體驗，支持多語言切換，並符合基本的隱私與GDPR要求。安全方面，網站使用HTTPS，實施Cookie同意機制，但缺乏明確的安全政策與事件響應資訊，且WHOIS資料缺失，對域名註冊狀態造成信任疑慮。整體風險中等，建議加強安全政策透明度及域名註冊資訊核實。

Scanned

NIS2 and GDPR posture

GDPR outside view
50/ 100 · Medium
Checks completed
7of 7

NIS2 Art. 21(2)

  1. (a) Risk analysis and security policies: Not visible from outside
  2. (b) Incident handling: One indicator
  3. (c) Business continuity, backups and crisis management: Not visible from outside
  4. (d) Supply chain security: Not visible from outside
  5. (e) Secure acquisition, development and maintenance, including vulnerability handling: Partly checked
  6. (f) Assessing the effectiveness of security measures: Not visible from outside
  7. (g) Cyber hygiene and security training: Not visible from outside
  8. (h) Cryptography and encryption: Partly checked
  9. (i) HR security, access control and asset management: One indicator
  10. (j) Multi-factor authentication and secured communications: Not visible from outside

This scan rated NIS2 with an earlier keyword method that is no longer shown; rescan for the per-article view. Risk management, continuity, supply chain, training, MFA, management oversight (Art. 20) and incident reporting (Art. 23) need internal evidence, and Guard cannot tell whether NIS2 applies to this organisation.

GDPR is indicative only, based on publicly visible signals: Articles 7, 12, 13 and 32 of Regulation (EU) 2016/679 and Article 5(3) of the ePrivacy Directive. Not a certification or legal assessment.

Priority findings

6 findings rated critical or high. Fix these first.

  1. Security headers

    Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

    • High

      Missing X-Frame-Options header

      Prevents clickjacking attacks

      What to do: Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN"

    • High

      Missing Content-Security-Policy header

      Controls resources the browser is allowed to load

      What to do: Implement a Content-Security-Policy appropriate for your application

      • ASVS V3.4.3
      • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

  2. GDPR outside view

    These are the privacy signals visitors and data protection authorities look for under GDPR.

    • High

      No Privacy Policy found

      GDPR requires a clear and accessible privacy policy

      What to do: Add a comprehensive privacy policy page and link to it prominently

    • High

      No Cookie Policy found

      GDPR requires clear information about cookie usage

      What to do: Add a dedicated cookie policy explaining cookie usage and purposes

    • High

      Third-party services without privacy policy

      Detected services: Google Analytics, Facebook, YouTube, Cloudflare, Google APIs

      What to do: Document all third-party data sharing in your privacy policy

Need hands-on remediation? Email guard@offseq.com

Keep watching thetw.com

This scan found 25 issues across 6 checks. Monitoring re-runs those checks daily, emails you when something material changes and records each fix, so you can show progress.

Daily monitoring

Recommended

€25per month

  • TLS certificates and expiry
  • DNS records
  • SPF, DKIM and DMARC
  • Security headers
  • GDPR and NIS2 posture
  • Exposed services
  • Third-party trackers
  • Security score drift

Email alerts on material changes and an exportable JSON history of every change.

Billed monthly to your card. Cancel anytime. See sample alerts.

Full report

€39.90one-time

  • The complete analysis as a PDF you can cite
  • Email delivery with an unlock code
  • Lifetime access to this report

Prices incl. 21% VAT. Secure checkout by Mollie; sold by SEQ SIA, Latvia.

Results by check

Each check with its score, findings and the evidence it collected.

How this score is calculated

The security score runs 0–100, higher is better. It is the plain average of the security checks that completed in this scan, each counted equally. A check that could not run is left out: it counts neither as a pass nor as a fail.

Counted in this score

SSL/TLS
64
Security headers
35
Email security
55
DNS health
75
Network security
100
GDPR outside view
50
Average
63

Not counted

  • NIS2 outside view: Re-weights evidence from the TLS, email, DNS, network and hygiene checks, so counting it would count that evidence twice. Shown on its own.
  • OffSeq Observations: An AI reading of the site, useful context but not reproducible evidence. Shown on its own.

Findings that cap the score at 49

Each of these is serious on its own, so while any is present the site cannot rate better than high risk, however good the other checks are.

  • The certificate is not trusted by browsers
  • The website is not served over HTTPS
  • A database, remote desktop, file-sharing or Telnet service is reachable from the internet
  • The page loads a script from a compromised source
  • The domain registration has expired
  • SPF authorises every server to send mail as the domain

Partial scans

When the site blocks Guard or most checks cannot run, the score covers only the checks that ran (usually DNS and email), is capped at 75 and is shown as partial, without a risk level.

Risk levels

  • Critical0–25
  • High26–49
  • Medium50–75
  • Low76–100

Technical appendix

Business context, site observations and technical notes gathered during the scan, and the standards behind each reference.

Business context

Business profile

該公司定位為國際展覽代理與組展服務商，擁有多元化的展覽領域覆蓋，並與多個國際大型展覽保持合作關係，形成穩固的市場競爭優勢。業務模式以提供展覽代理、設計及相關服務為主，目標客戶為企業參展商及相關產業。網站展示了豐富的展覽資訊與最新消息，並透過社交媒體與合作夥伴擴展影響力。深圳子公司顯示其跨境業務拓展能力。整體業務運營成熟，具備良好的成長潛力與合作生態系統。

Security posture

網站安全基礎良好，全面使用HTTPS保障傳輸安全，並實施Cookie同意機制以符合GDPR要求。網站未發現明顯漏洞或敏感資料外洩，但缺少安全政策、事件響應及漏洞披露相關資訊，降低了安全透明度與用戶信任。第三方腳本使用廣泛，建議定期審核以防止潛在風險。WHOIS資料缺失是安全信任的主要隱憂，建議核實域名註冊狀態。整體安全成熟度中等，需加強政策與流程建設。

Recommendations

  1. 完善並公開網站安全政策與事件響應流程，提高安全透明度與用戶信任。
  2. 核實並更新域名WHOIS資料，確保域名註冊合法且信息完整。
  3. 實施並強化HTTP安全標頭，如Content-Security-Policy、X-Frame-Options等，提升防護能力。
  4. 定期審核第三方腳本與庫，防止引入安全漏洞。
  5. 增強網站無障礙設計，提升可訪問性與合規性。

Contact details published on the site

Addresses
Legal name
興隨興展覽股份有限公司
Site observations

Automated reading of the public site. Ratings are indicative.

Business

Company
興隨興展覽股份有限公司
Description
興隨興主要代理各類國際展覽，從安全器材、消費性電子、汽車零配件、各類專業機械、船舶、農機等10多個領域的大型展覽，皆有提供相關服務，更是每年美國最大消費性電子展CES、歐洲最大消費性電子展IFA Berlin展最主要的組展單位。
Key services
國際展覽代理, 展覽設計, 展覽服務, 協力廠商合作
Content quality
good
Branding
consistent

Technology

Stack
jQuery 2.2.4, Bootstrap 3.3.7, Bootstrap Material Design, Font Awesome 4.7.0, Animate.css 3.5.2, Swiper 3.4.2, Owl Carousel 2.2.1, Google Analytics, Google Tag Manager
Frameworks
Bootstrap, Bootstrap Material Design
Performance
moderate
Mobile
good
Accessibility
basic
SEO
good

Security

Observed score
80/100
Good practices seen
  • HTTPS enforced
  • Cookie consent banner implemented
  • No exposed sensitive data in HTML

Analytics and tracking

Services
Google Analytics, Visitor Queue
Tracking level
moderate
Privacy practices
good

Advertising

Tracking pixels
Visitor Queue
Marketing tools
Visitor Queue Personalisation
Transparency
basic

Site quality

Design
good
User experience
good
Content relevance
good
Navigation
good
Professionalism
good
Trustworthiness
high

Key observations

  1. Website is fully accessible with rich content in Traditional Chinese.
  2. No WAF or security blocking detected.
  3. Comprehensive privacy and cookie policies present with GDPR compliance.
  4. Multiple social media and partner links included.
  5. No visible security policy or incident response information.
  6. WHOIS data missing, indicating possible domain registration or privacy issues.
  7. Use of modern web technologies and analytics tools.
  8. Good mobile optimization and user experience.
  9. No adult or questionable content detected.
Technical notes

Notes

網站採用成熟且廣泛使用的前端技術棧，包括jQuery、Bootstrap及多種UI框架，確保良好的跨瀏覽器兼容性與響應式設計。整體性能屬於中等，部分資源依賴CDN加速。SEO優化良好，包含完整meta標籤與結構化數據。缺乏CMS明確標識，可能為定制開發。技術架構穩定，但可考慮引入更現代化框架與自動化部署以提升維護效率與性能。
Standards and sources

Reference chips under each finding point to the standard, regulation or specification the finding relates to. They are taken from the official datasets below and mapped conservatively: a finding with no defensible link shows none. NIS2 and GDPR references mark where a finding is relevant evidence, not a compliance verdict. Implementing Regulation (EU) 2024/2690 binds digital infrastructure and digital service providers; for other entities it is the most detailed public reading of the Article 21 measures. WCAG, EN 301 549, European Accessibility Act and Web Accessibility Directive references name the requirement an automated accessibility rule relates to; they are not a conformance verdict.

Retrieved 2026-10-25

Reviews of this site

Share your experience with thetw.com. Every review is verified by email and published after moderation.

Overall rating
Select a rating
4000 characters remaining

We’ll email you to confirm your review and keep your details private.

Community rating

No published reviews yet. Be the first to review thetw.com.

Feedback on this report

Rate this report, add an optional comment, and tell us if you want a security specialist to follow up.

Overall report quality
Select a rating
2000 characters remaining

We only use your feedback to improve Guard reports. Contact details are never shared.