bakery.example
Scanned Oct 19, 2026 · 9:12 AM CT · 2 findings · 65 checks
057/65Checks passed
0 need site verification6 skipped
Critical0
Warning2
Passed57
Ready ·
No blocking issues found. You’re good to launch.
The verdict is based on critical findings, not the score alone.
Passing every check doesn’t guarantee your app is secure.
Your fixes are in your email. We sent step-by-step fixes to owner@bakery.example.
Your full report is emailed to you as a PDF.
Findings
WarningContent-Security-Policy header is missing
WarningTwo pages have no meta description
What we checked
65 checks.
2 findings Example dataSkipped 6 checks. They didn’t apply to this site or we couldn’t reach the page.
- K1Payment secret keyPassed
- K2AI provider keyPassed
- K3Supabase service_role keyPassed
- K4Cloud and service account secretsPassed
- K5Other app secretsPassed
- K6Publishable keys (fine)Passed
- D1Supabase tables readable signed-outPassed
- D2Supabase schema listing openPassed
- D3Supabase storage buckets listablePassed
- D4Firebase Realtime Database openPassed
- D5Firestore / Firebase Storage openPassed
- F1Environment file exposedPassed
- F2Git folder exposedPassed
- F3Backups and config files exposedPassed
- F4Source maps publicPassed
- F5Folder listing onPassed
- A1Admin page open without loginPassed
- A2API docs or debug pages openPassed
- A3Error page shows technical detailsPassed
- T1Certificate validPassed
- T2Certificate expiring soonPassed
- T3HTTP and www go to HTTPSPassed
- T4HSTS setPassed
- T5Mixed contentPassed
- H1Content-Security-PolicyWarning
- H2Clickjacking protectionPassed
- H3No-sniffPassed
- H4Referrer-PolicyPassed
- H5Version details leakedPassed
- H6Integrity check on outside scripts and stylesPassed
- H7Permissions-PolicyPassed
- L1JavaScript libraries with known flawsPassed
- C1Cookies marked SecureNothing to test (no cookies found)Skipped
- C2Session-like cookies HttpOnlyNothing to test (no cookies found)Skipped
- C3SameSite setNothing to test (no cookies found)Skipped
- C4CORS open to any sitePassed
- E1SPFNot on this site (no email domain set up)Skipped
- E2DMARCNot on this site (no email domain set up)Skipped
- E3DKIM (common selectors)Not on this site (no email domain set up)Skipped
- E4CAAPassed
- E5Mail server (MX) set upPassed
- S1robots.txt not blocking everythingPassed
- S2SitemapPassed
- S3No accidental noindexPassed
- S4Canonical addressPassed
- S5Content visible without JavaScriptPassed
- S6Privacy and terms pagesPassed
- O1Page titlePassed
- O2Unique titlesPassed
- O3Meta descriptionWarning
- O4Link previewsPassed
- O5One main headingPassed
- O6Broken internal linksPassed
- O7Broken outside linksPassed
- Y1Page languagePassed
- Y2Image alt textPassed
- Y3Form labelsPassed
- Y4Colour contrastPassed
- Y5Zoom allowedPassed
- P1Main content load timePassed
- P2Layout jumpingPassed
- P3Page and script weightPassed
- P4Oversized imagesPassed
- P5CachingPassed
- P6CompressionPassed
Sample report · example data · not a real site