Scan Report: wptest.kaideutsch.de

01

WHOIS & DNS

DNS records retrieved — SPF & DMARC present

· LOW

▸

// whois

// dns records

A                     159.69.224.3
AAAA                  2a01:4f8:d0a:650e::2
www A                 159.69.224.3
www AAAA              2a01:4f8:d0a:650e::2
MX 10                 www521.your-server.de

// ip whois (1)

159.69.224.3          SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗

// lookup on dnsarchive.net

same IP 159.69.224.3 ↗

same MX www521.your-server.de ↗

// email security

✓ SPF

v=spf1 a mx a:my.cldrn.meinsandkasten.de a:cldrn.meinsandkasten.de ip4:188.245.181.166 -all

✓ DMARC

v=DMARC1;p=quarantine;sp=quarantine;pct=75;adkim=r;aspf=r;

// findings (6)

✓ ok SPF record present
✓ ok DMARC record present
✓ ok 1 MX record(s) configured
· low No CAA records — any certificate authority can issue certs for this domain
· low No MTA-STS DNS record at _mta-sts — inbound mail can be downgraded
· low No TLS-RPT record at _smtp._tls — no visibility into TLS delivery failures

// external references

DNS history on dnsarchive.net ↗

02

SSL / TLS Certificate

Valid certificate, expires in 63 days — TLSv1.3

✓ OK

▸

03

CMS Detection

WordPress detected — 5 plugins found

✓ OK

▸

04

Security Headers

1 of 7 headers missing

◐ MEDIUM

▸

// raw output

HSTS                        ok (max-age=15768000; includeSubDomains; pre)
CSP                         ok (default-src 'self'; script-src 'self' 'u)
X-Frame-Options             ok (SAMEORIGIN)
X-Content-Type-Options      ok (nosniff)
Referrer-Policy             ok (strict-origin-when-cross-origin)
Permissions-Policy          ok (accelerometer=(), camera=(), geolocation)
Cross-Origin-Opener         MISSING

// findings (11)

· low Cross-Origin-Opener-Policy not set
✓ ok Referrer-Policy is configured
✓ ok X-Frame-Options is configured
✓ ok Permissions-Policy is configured
✓ ok X-Content-Type-Options is configured
✓ ok Content-Security-Policy is configured
✓ ok Strict-Transport-Security is configured
◐ medium CSP weakness — 'unsafe-inline' in script-src — defeats most XSS protection
◐ medium CSP weakness — 'unsafe-eval' in script-src — allows eval() and increases XSS risk
◐ medium CSP weakness — no frame-ancestors — clickjacking only protected by X-Frame-Options
· low No /.well-known/security.txt — researchers cannot find a contact for vulnerability reports

05

Raw HTTP Headers

HTTP/3 · 13 headers · Apache

· LOW

▸

// detected

◉ Apache Web server: Apache

⚡ HTTP/3 HTTP/3 (QUIC) in use — fastest available protocol, low latency and connection migration

// raw headers (13)

status                        HTTP/3 200
date                          Mon, 25 May 2026 16:22:07 GMT
link                          <https://wptest.kaideutsch.de/wp-json/>; rel="https://api.w.org/", <https://wpte… 
vary                          Accept-Encoding
server                        Apache
content-type                  text/html; charset=UTF-8
cache-control                 max-age=0, no-cache
referrer-policy               strict-origin-when-cross-origin
x-frame-options               SAMEORIGIN
permissions-policy            accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), micr… 
x-content-type-options        nosniff
content-security-policy       default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://wpte… 
strict-transport-security     max-age=15768000; includeSubDomains; preload

// findings (4)

✓ ok Web server: Apache
✓ ok HTTP/3 enabled — best available
· low No response compression detected — consider enabling GZIP or Brotli
✓ ok Cache-Control: max-age=0, no-cache

06

External JS Libraries

No external JS libraries detected

✓ OK

▸

07

Malware & Blocklists

Threats detected — 2 suspicious indicator(s)

◐ MEDIUM

▸