Scan Report: dsm.edu.ni

01

WHOIS & DNS

DNS records retrieved — email policy issues found

◐ MEDIUM

▸

02

SSL / TLS Certificate

Valid certificate, expires in 67 days — TLSv1.3

✓ OK

▸

03

CMS Detection

WordPress detected — 9 plugins found

◐ MEDIUM

▸

04

Security Headers

7 of 7 headers missing

▲ HIGH

▾

// raw output

HSTS                        MISSING
CSP                         MISSING
X-Frame-Options             MISSING
X-Content-Type-Options      MISSING
Referrer-Policy             MISSING
Permissions-Policy          MISSING
Cross-Origin-Opener         MISSING

// findings (8)

◐ medium HSTS not set — browsers may allow HTTP connections
▲ high X-Content-Type-Options missing — MIME-sniffing possible
▲ high X-Frame-Options missing — clickjacking attacks possible
◐ medium Referrer-Policy missing — leaking referrer data to third parties
◐ medium Content-Security-Policy missing — site exposed to XSS injection
◐ medium Permissions-Policy missing — browser features not restricted
· low Cross-Origin-Opener-Policy not set
· low No /.well-known/security.txt — researchers cannot find a contact for vulnerability reports

05

Raw HTTP Headers

HTTP/3 · 9 headers · Apache

◐ MEDIUM

▸

// detected

◉ Apache Web server: Apache

⚡ HTTP/3 HTTP/3 (QUIC) in use — fastest available protocol, low latency and connection migration

▲ Cookie flags missing 1 of 1 cookie(s) missing security flags

// raw headers (9)

status                        HTTP/3 200
date                          Tue, 08 Sep 2026 17:44:23 GMT
link                          <https://dsm.edu.ni/wp-json/>; rel="https://api.w.org/", <https://dsm.edu.ni/wp-… 
server                        Apache
set-cookie                    pll_language=es; expires=Wed, 08-Sep-2027 17:44:23 GMT; Max-Age=31536000; path=/… 
content-type                  text/html; charset=UTF-8
x-tec-api-root                https://dsm.edu.ni/wp-json/tribe/events/v1/
x-tec-api-origin              https://dsm.edu.ni
x-tec-api-version             v1

// findings (4)

✓ ok Web server: Apache
✓ ok HTTP/3 enabled — best available
· low No response compression detected — consider enabling GZIP or Brotli
◐ medium Cookie pll_language (missing: HttpOnly)

06

External JS Libraries

No external JS libraries detected

✓ OK

▸

07

Malware & Blocklists

Clean — not present on any monitored blocklist

✓ OK

▸