01
Start here
illustration
Serious
A forged invoice would quote your real contract
You supply a federal department under a contract worth up to £9,600,000, until 26 June 2027. The public contract register publishes all of that, with the agency's own reference and the branch on the notice. The record for example.com tells mail servers to take no action on forged email.
So anyone can write to that branch from an address at example.com, quote the real contract and reference, and ask for the next payment to go to a new bank account.
The proof
A federal department, £9,600,000, to 26 June 2027
The public contract registerRead 29 October 2026example.com publishes a DMARC record that only monitors
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Read 29 October 2026
The fix
Move the DMARC record for example.com from monitoring to enforcement once your real senders pass. Until then, ask that department to confirm any change of bank details by phone, on a number it already holds.
What else stands out
One near-identical address has mail set up
Serious
example.org is registered and has mail servers set up. It is your name with a different ending. We cannot see that it is yours. Mail sent there by mistake reaches whoever holds it, and what they send looks like you.
The fix. If it is yours, add it to your list of domains and set its records to refuse forged email. If not, warn your accounts team and ask its registrar to act.
Two names you may have forgotten still answer
Worth fixing
Certificate logs keep every name a firm has ever secured. staging.example.com is a test name, and anyone can open it. vpn.example.com still answers, and the certificate it serves has lapsed.
The fix. Close what nobody uses, and give each of the rest an owner and a sign-in that is not open to everyone.
Six outside companies can send email as you
Worth knowing
Six outside companies can send email as example.com. If any one of them is broken into, what it sends in your name passes your own checks.
The fix. Name an owner for each one, and take out any that nobody here can name.
02
For the board
illustration
59
names you did not give us
old-portal.example.com staging.example.com tracking.example.com vpn.example.com and 55 more under Your footprint
A note for the board
Three findings need attention this week, and each is a short job for whoever holds the access.
The rest can follow in the normal run of work.
We will take you through all of it on the walkthrough.
Grades
External indicators, read from the outside. A domain's row reads its email and its main site. Footprint reads every hostname, so anything wrong elsewhere shows there.
Grades by domain and dimension
| Email security | Web security | Certificates | Privacy |
|---|
example.com | C10 of 10 read | C24 of 27 read | A5 of 5 read | B4 of 5 read |
|---|
example.net | A10 of 10 read | NOT STATED2 of 27 read | B4 of 5 read | NOT STATED1 of 5 read |
|---|
Verdicts
Compromise
Clear
We read all 48 live hosts, and none showed the signs of a break-in.
Email in your name
Can be faked
Your DMARC record watches forgeries rather than stopping them.
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Read 29 October 2026
Exposed files and details
Found
2 files or details open to anyone who asks. Listed under Findings.
Software on show
1 on the exploited list
1 version your pages state falls inside a flaw attackers are known to be using.
Breach history
Not listed
Have I Been Pwned's public list holds nothing under your domains. Your staff's addresses are a separate question, set out under Credentials.
The five actions that matter most
- 1Delete the record behind old-portal.example.comSerious10 minutesWhoever runs your DNS
- 2Move your DMARC policy on from p=noneSerious10 minutesWhoever runs your DNS
- 3Renew the certificate on vpn.example.comSerious30 minutesYour IT provider
- 4Stop the uploads folder listing its filesWorth fixing10 minutesYour web developer
- 5Put a script policy on your main siteWorth fixing90 minutesYour web developer
What we could not read
intranet.example.comDNS did not answer on either try.dev.example.netNothing answered on 443 or 80 in the time allowed.
Email security1 finding
Your DMARC record watches forgeries rather than stopping them
Serious
example.com
Email in your name can be faked. A receiver that detects a forged message from you will usually still deliver it.
p=none is the monitoring setting. It is the right place to start and the wrong place to stay.
- Where we read it
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"- When
- 29 October 2026, 14:02 GMT
The fix10 minutes
_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
This is the record we read with one change: p=none becomes p=quarantine. Publish it once your reports show every service that sends as you passing, which usually takes 4 to 8 weeks of reading them. Then move to p=reject.
How we will know it is fixed. The next read of DMARC policy shows the change.
How the grade was worked out
Web security1 finding
Nothing limits what scripts are allowed to run on your pages
Worth fixing
www.example.com
If anything ever injects a script, through a plugin somebody has altered or a third-party tag that gets taken over, it runs with the full run of the page.
A policy is the difference between an incident and a non-event.
- Where we read it
https://www.example.com/ sent no Content-Security-Policy header- When
- 29 October 2026, 14:05 GMT
The fix90 minutes
Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'; frame-ancestors 'self'
Deploy it as Report-Only first: as written it blocks nothing and reports what it would have blocked. Read those for a week, add the third parties you use, then drop -Report-Only.
How we will know it is fixed. The next read of Content-Security-Policy header shows the change.
How the grade was worked out
CertificatesNothing to fix
How the grade was worked out
PrivacyNothing to fix
How the grade was worked out
Footprint4 findings
A subdomain anyone can claim
Serious
old-portal.example.com
This name points at a provider resource nobody holds. A stranger can claim that resource and serve whatever they like at your address.
A claimed subdomain sits inside your own domain, so its pages and its email look like yours.
- Where we read it
old-portal.example.com CNAME example-old.azurewebsites.net (the target does not resolve)- When
- 29 October 2026, 14:02 GMT
The fix10 minutes
Delete this record:
old-portal.example.com CNAME example-old.azurewebsites.net
How we will know it is fixed. The next read of the dangling names in your DNS shows the change.
The certificate on this host has lapsed
Serious
vpn.example.com
Until it is renewed, every person who connects sees a full-page browser warning, and your staff learn to click through warnings.
A lapsed certificate proves nothing to the person connecting.
- Where we read it
https://vpn.example.com/ certificate, issued by DigiCert- When
- 29 October 2026, 14:02 GMT
The fix30 minutes
Renew it with whoever issued it, then put its renewal date in a diary somebody reads.
How we will know it is fixed. The next read of the certificate expiry date shows the change.
This host answers on plain HTTP only
Worth fixing
tracking.example.com
Everything sent to this host can be read and altered on the way.
Nothing a person sends to it is private.
- Where we read it
http://tracking.example.com/ answered; https://tracking.example.com/ did not- When
- 30 October 2026, 09:41 GMT
The fix45 minutes
Put a certificate on it and redirect HTTP to HTTPS, or take it offline if nobody needs it.
How we will know it is fixed. The next read of the hosts on plain HTTP shows the change.
A name where nothing answered on the web
Tidy up
legacy.example.com
Nothing answered on the web at this name. If the service has gone and the address is ever reassigned, your name points at a stranger.
An old record is a small risk that costs nothing to remove.
- Where we read it
legacy.example.com A 203.0.113.14 (nothing listens on 443 or 80)- When
- 30 October 2026, 09:41 GMT
The fix5 minutes
Delete this record:
legacy.example.com A 203.0.113.14
How we will know it is fixed. The next read of the names with nothing behind them shows the change.
How the grade was worked out
Exposed files and details2 findings
Folder anyone can browse
Worth fixing
www.example.com
This folder lists its files to anyone who opens it, including documents nobody meant to publish.
Anything uploaded for one person is open to everybody.
- Where we read it
https://www.example.com/wp-content/uploads/- When
- 30 October 2026, 09:47 GMT
The fix10 minutes
Options -Indexes
Add that line to the site's .htaccess file, or ask your host to turn directory listing off.
How we will know it is fixed. The next read of the folder listing shows the change.
Software version advertised
Tidy up
staging.example.com
This page tells anyone which version of WordPress the site runs. The version is behind the current one.
A version number is the first thing anyone looking for an old site reads.
- Where we read it
https://staging.example.com/readme.html- When
- 30 October 2026, 09:47 GMT
The fix15 minutes
Update WordPress, then delete readme.html from the web root. The update puts it back, so make deleting it part of updating.
How we will know it is fixed. The next read of the WordPress version on show shows the change.
Software versions your public pages state
| Software | Version | Where it says so | What is known |
|---|
| jQuery |
1.12.4 |
portal.example.com
https://portal.example.com/js/jquery-1.12.4.min.js |
On the known exploited list: CVE-2020-11023, listed 23 January 2025. Fixed in 3.5.0. Chance of attacks in the next 30 days, by EPSS: 85%.
No longer gets security fixes.
3 other published flaws. |
| Microsoft IIS |
8.5 |
vpn.example.com
Server: Microsoft-IIS/8.5 |
Security fixes ended 25 October 2023. |
| Apache HTTP Server |
2.4.52 |
tracking.example.com
Server: Apache/2.4.52 (Ubuntu) |
Built by a Linux distribution, so the number says nothing about its fixes. |
A number is what the page states. A fix carried back by whoever runs the software would not change it, so IT may know more than this table can. Flaw records read 29 October 2026, the known exploited list 29 October 2026, support dates 29 October 2026.
- 1,240pages it holds under your domains
- 2hostnames it has crawled
- 1name our other reads did not give
Names it gave us
tenders.example.com. These are in Your footprint, read like every other name. A wildcard certificate hides a name from the certificate logs, and a crawler still finds it.
Pages a public web index holds that read as sign-in, admin, test or old pages
| Address | Reads as | Last seen | Today |
|---|
https://portal.example.com/login | Sign-in page | 29 September 2026 | Still answers, with a sign-in |
|---|
https://www.example.com/test/ | Test page | 28 November 2024 | Still answers |
|---|
https://www.example.com/old/ | Old page | 20 September 2022 | Gone, or closed (404) |
|---|
What the properties of your public documents hold
| Document | Carries | Made with |
|---|
annual-report.pdf | Login name j.citizen
Path S:\Finance\Reports\annual-report-final.docx | Microsoft Word 2016 |
|---|
supplier-terms.pdf | No login, path or author. | Adobe InDesign 18.0 |
|---|
Read from each file's own properties. Anyone who opens the file can see the same.
Have I Been Pwned's public list of 1,048 breached sites holds nothing under example.com, example.net.
Read 29 October 2026. Source: Have I Been Pwned, under CC BY 4.0.
Check your own staff's addresses
The list above is of sites that were breached. Most of your staff's exposure sits in the breaches of other sites, and only you can ask about that. It takes about ten minutes.
- Open Have I Been Pwned, go to the Dashboard and sign in with a work email address. It sends a link to that address.
- Under Domains, add
example.com. - Prove you control it, by the record, the file, the meta tag or the admin mailbox it offers you. Whoever runs your DNS can do the first in five minutes.
- Read the list. It shows each address on your domain that sits in a known breach, and which breaches. It is free for a domain with up to 10 breached addresses, and a larger domain takes a subscription.
- For each address still in use, change the password anywhere it was used, and turn on two-step sign-in. Leave the domain on, and it tells you of the next one.
What we read
- The pages your sites serve at the addresses they advertise
- DNS, certificates and the public certificate logs
- The domain registries
- AusTender's contract notices, where your name is on them
- The properties of documents your pages link to
- A public web index, for your own domains
- A public list of breached sites, matched against your domains
With your authorisation
Authorised by the finance director on 29 October 2026.
- The well-known paths a site never advertises, on the hostnames you confirm: /.git/HEAD, /.env, a backup in the web root, a browsable upload folder, phpinfo and the WordPress debug log.
- Pages a public web index holds for those hostnames that read as sign-in, admin, test or old pages, each read once to see whether it still answers. At most 12.
- GET requests only, at most 8 a host, and a file counts only when its content proves it.
- Sources
- Certificate logs, through crt.sh. Public DNS. The registries' RDAP records. Public contract notices, through AusTender. Common Crawl's public web index. Have I Been Pwned's public list of breached sites.
- Grades
- Rubric
bondstone/rubric-v1. One grade per dimension, 100 less its deductions. An A needs every input read, and under three inputs a dimension says NOT STATED.
- When
- Read between 29 and 30 October 2026.
Software versions were matched offline. Known exploited flaws: the catalogue published by the US Cybersecurity and Infrastructure Security Agency, which does not endorse this report. Version ranges: the GitHub Advisory Database under CC BY 4.0, through OSV.dev. Attack likelihood: EPSS, from FIRST (first.org/epss), scores by Empirical Security. Support dates: endoflife.date. CVE identifiers are copyright The MITRE Corporation.
Everything here can be checked by you. Every finding names the place and the day, and every grade shows its sum.
10
Monitoring
illustration
Mid
£750a month
Starts the week after delivery, on a 12-month term, billed monthly.
What we watch
- Every weekNew names in the certificate logs, hosts gone quiet, dangling names, lapsed domains, signs of a compromise, every certificate, and every domain's SPF and DMARC
- Every quarterYour grades again, and a short summary
What an alert says
- What changed, where and when we read it, and what to do, with the record to paste.
- At most one email a day.
- An all-clear every four weeks when nothing changes.
- When a fix lands, the next read proves it and we tell you that too.