Security report for websignal.eu

10 findings rated critical or high. Fix these first.

1. GDPR compliance

   See the evidence for GDPR compliance

   These are the privacy signals visitors and data protection authorities look for under GDPR.

   • Critical

     EU business without adequate privacy measures

     EU businesses are subject to strict GDPR requirements

     What to do: Implement comprehensive GDPR compliance including privacy policy, cookie consent, and data protection measures

     References

     • GDPR Art. 13
     • ePrivacy Art. 5(3)
   • High

     No Privacy Policy found

     GDPR requires a clear and accessible privacy policy

     What to do: Add a comprehensive privacy policy page and link to it prominently

     References

     • GDPR Art. 12
     • GDPR Art. 13
     • NIST PT-5: NIST SP 800-53 Rev. 5 PT-5: Privacy Notice
   • High

     No Cookie Policy found

     GDPR requires clear information about cookie usage

     What to do: Add a dedicated cookie policy explaining cookie usage and purposes

     References

     • ePrivacy Art. 5(3)
   • High

     No Cookie Consent Banner found

     GDPR requires explicit consent for non-essential cookies

     What to do: Implement a cookie consent banner that appears on first visit

     References

     • GDPR Art. 7
     • ePrivacy Art. 5(3)
     • NIST PT-4: NIST SP 800-53 Rev. 5 PT-4: Consent

2. Security headers

   See the evidence for Security headers

   Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

   • High

     Missing Content-Security-Policy header

     Controls resources the browser is allowed to load

     What to do: Implement a Content-Security-Policy appropriate for your application

     References

     • ASVS V3.4.3
     • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

3. NIS2 compliance

   See the evidence for NIS2 compliance

   NIS2 expects organisations in scope to show basic security hygiene. These public signals are what an auditor or customer sees first.

   • High

     No information security framework found

     NIS2 requires documented cybersecurity and information security measures

     What to do: Implement and document information security policies and procedures

     References

     • NIS2 21(2)(a)
     • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
     • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
   • High

     No security policy documentation found

     NIS2 requires documented cybersecurity governance and risk management

     What to do: Create and publish cybersecurity policy and framework documentation

     References

     • NIS2 21(2)(a)
     • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
     • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
   • High

     No incident response procedures found

     NIS2 requires documented incident response and business continuity plans

     What to do: Implement and document incident response and business continuity procedures

     References

     • NIS2 21(2)(b)
     • IR 2024/2690 3.1: Implementing Regulation (EU) 2024/2690, Annex point 3.1: Incident handling policy
     • NIST IR-8: NIST SP 800-53 Rev. 5 IR-8: Incident Response Plan
   • High

     No security contact information

     NIS2 requires clear incident reporting channels

     What to do: Add security contact information (e.g., security@domain.com)

     References

     • RFC 9116 §2.5.3
     • NIS2 21(2)(b)
     • IR 2024/2690 3.3: Implementing Regulation (EU) 2024/2690, Annex point 3.3: Event reporting
   • High

     Critical sector without clear security compliance

     Detected sectors: transport

     What to do: Critical sectors require comprehensive NIS2 compliance program

     References

     • NIS2 21(1)