Website Security Findings
Findings are what Nivaronix’s scanner actually reports back after checking a site: a specific, named issue — a missing header, an unenforced email-authentication policy, a certificate about to expire — each with a severity rating, the exact evidence behind it, and a fix. Every finding page below documents one of those exact results, so if a scan of your site surfaces it, you can read precisely what it means before you act on it.
These come from configuration and posture checks — security headers, SSL/TLS certificates, DNS/DNSSEC/CAA records, SPF/DMARC/DKIM email authentication, and a small set of crawlability signals that are SEO rather than security — not from malware scanning, exploit testing, or a penetration test. A finding here describes a gap between your current configuration and a known-good baseline, with a straightforward way to close it.
All findings
- Missing HSTS Header
What a missing Strict-Transport-Security header means, why it matters, and how to add HSTS on Nginx, Apache and Cloudflare.
- Missing Content-Security-Policy
What a missing Content-Security-Policy header means, why it matters for XSS defense, and how to add CSP on Nginx, Apache and Cloudflare.
- Missing X-Frame-Options Header
What a missing X-Frame-Options header means, why it enables clickjacking, and how to add it on Nginx, Apache and Cloudflare.
- X-Frame-Options Overridden by Permissive CSP
What it means when X-Frame-Options is set but a permissive Content-Security-Policy frame-ancestors directive overrides it, why browsers obey the CSP, severity, and how to fix the directive.
- Missing X-Content-Type-Options Header
What a missing X-Content-Type-Options header means, why MIME-sniffing is a risk, and how to add nosniff on Nginx, Apache and Cloudflare.
- Deprecated X-XSS-Protection Header
Why the X-XSS-Protection header is deprecated, what Nivaronix flags when it's present, and how to remove it safely.
- Self-Signed Certificate
What a self-signed certificate finding means, why it matters, severity, and how to replace it with a trusted CA certificate.
- SSL Certificate Expiring
What an SSL certificate expiring finding means, why it matters, severity, and how to renew before browsers show a warning.
- DNSSEC Not Enabled
What it means when Nivaronix reports DNSSEC Not Enabled, why it matters, severity, and how to enable DNSSEC without breaking your domain's resolution.
- No CAA Record
What it means when Nivaronix reports no CAA record, why it matters, severity, and how to publish a CAA record restricting certificate issuance to your CA.
- SPF Record Enforces a Hard Fail (-all)
What it means when Nivaronix reports an SPF hard fail, why -all is the strongest SPF setting, and how to verify your own record.
- DMARC Policy Is Monitoring Only (p=none)
What it means when Nivaronix reports a p=none DMARC policy, why monitor-only isn't protection, severity, and how to move to enforcement safely.
- Missing Referrer-Policy Header
What a missing Referrer-Policy header means, why it leaks URL data to third parties, and how to add it on Nginx, Apache and Cloudflare.
- Missing Permissions-Policy Header
What a missing Permissions-Policy header means, why it leaves browser APIs like camera and geolocation unrestricted, and how to add it on Nginx, Apache and Cloudflare.
- No HTTPS
What it means when Nivaronix reports no HTTPS, why it matters, severity, and how to enable HTTPS on your web server.
- Invalid SSL Certificate
What it means when Nivaronix reports an invalid SSL certificate, why it matters, severity, and how to install a valid certificate from a trusted CA.
- Expired SSL Certificate
What it means when Nivaronix reports an expired SSL certificate, why it matters, severity, and how to renew it immediately.
- Certificate Does Not Match This Domain
What it means when Nivaronix reports a certificate hostname mismatch, why it matters, severity, and how to reissue a certificate that covers the domain.
- Weak TLS Version
What it means when Nivaronix reports a weak TLS version, why outdated TLS matters, severity, and how to upgrade to TLS 1.2 or higher.
- Certificate Could Not Be Verified
What it means when Nivaronix can't verify a site's certificate against the trust store, why it matters, severity, and how to fix it.
- Incomplete Certificate Chain
What it means when Nivaronix reports an incomplete certificate chain, why it matters, severity, and how to serve the full chain including the intermediate certificate.
- Certificate Authority Not Trusted
What it means when Nivaronix reports an untrusted certificate authority, why it matters, severity, and how to reissue through a publicly trusted CA.
- Insecure Redirect Chain
What it means when Nivaronix reports an insecure redirect chain, why it matters, severity, and how to fix an HTTP redirect that doesn't end in HTTPS.
- Redirect Without Location
What it means when Nivaronix reports a redirect without a Location header, why it matters, severity, and how to fix it.
- No HTTPS Redirect
What it means when Nivaronix reports no HTTPS redirect, why it matters, severity, and how to redirect HTTP to HTTPS on Nginx, Apache and Cloudflare.
- Cookie Missing Secure Flag
What it means when Nivaronix reports a cookie missing the Secure flag, why it matters, severity, and how to add it in Express, Django, Rails and at the header level.
- Cookie Missing HttpOnly Flag
What it means when Nivaronix reports a cookie missing the HttpOnly flag, why it matters, severity, and how to add it in Express, Django, Rails and at the header level.
- Cookie Missing SameSite Attribute
What it means when Nivaronix reports a cookie missing the SameSite attribute, why it matters for CSRF, severity, and how to set it in Express, Django, Rails and at the header level.
- No Reverse DNS
What it means when Nivaronix reports no reverse DNS for your server's IP, why it affects email deliverability, and how to add a PTR record.
- Invalid IP Address
What it means when Nivaronix reports your domain resolves to an invalid IP range, why it happens, severity, and how to fix the DNS A record.
- DNS Resolution Failed
What it means when Nivaronix cannot resolve your domain at all, common causes, severity, and how to verify your A/AAAA and nameserver configuration.
- No SPF Record
What it means when Nivaronix reports no SPF record at all, why it makes your domain easy to spoof, severity, and how to publish one.
- Multiple SPF Records Published
What it means when Nivaronix finds more than one SPF record on your domain, why RFC 7208 makes this as bad as no SPF, and how to merge them.
- SPF Set to Soft Fail
What it means when Nivaronix reports your SPF record ends in ~all, why soft fail is a transition state, and when to move to a hard fail.
- SPF Record Provides No Protection
What it means when Nivaronix reports your SPF record ends in +all or ?all, why it exists but stops nobody, and how to fix it.
- SPF Record Has No Final Policy
What it means when Nivaronix reports your SPF record has no all mechanism, why receivers are left with a neutral result, and how to fix it.
- No DMARC Record
What it means when Nivaronix reports no DMARC record at all, why it leaves SPF unenforced, severity, and how to publish one starting at p=none.
- DMARC Record Has No Usable Policy Tag
What it means when Nivaronix reports your DMARC record's p= tag is missing or invalid, why receivers ignore it, and how to fix it.
- SPF Record Approaching or Over the 10-Lookup Limit
What it means when Nivaronix reports your SPF record is near or over RFC 7208's 10-lookup limit, why exceeding it breaks SPF entirely, and how to flatten it.
- Domain Is Signed With DNSSEC But Did Not Resolve
What it means when Nivaronix finds a DS record but cannot resolve your domain, why a stale DS record after key rotation causes this, and how to fix it.
- SPF Policy Delegated With redirect=
What it means when Nivaronix reports your SPF record uses a redirect= modifier, why the effective policy lives elsewhere, and what to check.
- No DKIM Record Found at Common Selectors
What it means when Nivaronix finds no DKIM record at any common selector, why that's a selector-based check rather than a directory lookup, severity, and how to fix it.
- Canonical Tag Missing
What it means when Nivaronix finds no canonical tag on a scanned page, why it's an SEO signal rather than a security finding, and how to add one.
- Page Excluded From Search Indexing (noindex)
What it means when Nivaronix detects a noindex signal on a scanned page, why it's an SEO signal rather than a security finding, and when it's actually a mistake.
- robots.txt Not Found
What it means when Nivaronix finds no robots.txt at your domain, why it's an SEO signal rather than a security finding, and how to add one.
- sitemap.xml Not Found
What it means when Nivaronix finds no sitemap.xml at your domain, why it's an SEO signal rather than a security finding, and how to add one.
Find out which of these apply to you
These findings only mean something once you know which ones your own site triggers. A free scan checks all of them against your domain and returns the exact results, with evidence.
Scan your site for free