Red Castle Studio

Website Security Audit

Sample report: civilengineerjobs.net

A real audit report for civilengineerjobs.net, a site Red Castle Studio runs.

Request an audit About the audit

Summary

B

Good, with a few improvements worth making.

Score 80 out of 100

3 Medium1 Low

The site gets the basics right: visitors are moved to HTTPS, strong security headers are in place, no sensitive files are exposed, and SPF is set up correctly.

There are three medium issues and one low issue. The server still accepts the outdated TLS 1.0 and TLS 1.1 protocols, DMARC is in monitoring mode only, and there is no CAA record limiting who may issue certificates for the domain.

What to do first

  1. Disable TLS 1.0 on the server or CDN and allow only TLS 1.2 and TLS 1.3.
  2. Disable TLS 1.1 on the server or CDN and allow only TLS 1.2 and TLS 1.3.
  3. Once the reports show that all your legitimate email passes, change the DMARC policy to p=quarantine, then p=reject.

Checked · civilengineerjobs.net

Findings by area

Exposed files

What is working well

  • No common sensitive files are exposed
  • Folder contents are not listed publicly
  • A security contact file (security.txt) is published

Website software (CMS and plugins)

  • For informationNo WordPress, Joomla or Drupal detected

    The site does not appear to run one of the common content management systems checked here.

    What to do: No action needed.

HTTPS certificate and encryption

  • MediumThe server still accepts TLS 1.0

    TLS 1.0 is an outdated encryption protocol with known weaknesses. Modern browsers no longer use it, and payment card rules (PCI DSS) forbid it.

    What to do: Disable TLS 1.0 on the server or CDN and allow only TLS 1.2 and TLS 1.3.

  • MediumThe server still accepts TLS 1.1

    TLS 1.1 is an outdated encryption protocol with known weaknesses. Modern browsers no longer use it, and payment card rules (PCI DSS) forbid it.

    What to do: Disable TLS 1.1 on the server or CDN and allow only TLS 1.2 and TLS 1.3.

What is working well

  • The HTTPS certificate is valid
  • The full certificate chain is served

Website and security headers

  • For informationwww.civilengineerjobs.net does not exist

    Visitors who type www.civilengineerjobs.net get a "site can't be reached" error.

    What to do: Optional: add a DNS record for www.civilengineerjobs.net and redirect it to civilengineerjobs.net.

What is working well

  • Visitors are moved to the secure (HTTPS) version
  • Browsers are told to always use HTTPS
  • A Content Security Policy restricts scripts
  • Browsers are told not to guess file types
  • Other sites cannot embed this site in a frame
  • Referrer-Policy is set
  • Permissions-Policy is set
  • No software versions announced in headers
  • The homepage sets no cookies

Domain and email security

  • MediumDMARC is in monitoring mode only (p=none)

    The policy only collects reports; fake emails using your domain are still delivered normally.

    What to do: Once the reports show that all your legitimate email passes, change the policy to p=quarantine, then p=reject.

  • LowAny certificate authority may issue certificates for this domain

    A CAA record names the companies allowed to issue HTTPS certificates for your domain, which makes a fraudulent certificate harder to obtain.

    What to do: Add a CAA record for the certificate authority you use.

  • For informationNo DKIM key found under common names

    DKIM keys live under a name chosen by your email provider, so they cannot all be found from outside. This is not necessarily a problem.

    What to do: Confirm in your email provider's settings (Google Workspace, Microsoft 365, etc.) that DKIM signing is turned on.

  • For informationMail servers are configured

    The domain receives email through these servers.

    What to do: No action needed.

  • For informationDNSSEC is not enabled

    DNSSEC signs DNS answers so they cannot be forged. It is good practice but uncommon for small business sites.

    What to do: Optional: enable DNSSEC at your DNS provider (often one click at Cloudflare).

What is working well

  • SPF is set up correctly

Technical appendix

The raw values observed, for a web developer or hosting provider. Secret values are masked.

  1. 1.The server still accepts TLS 1.0Medium

    tls.tls10-enabled

    Handshake with civilengineerjobs.net using TLS 1.0 succeeded

  2. 2.The server still accepts TLS 1.1Medium

    tls.tls11-enabled

    Handshake with civilengineerjobs.net using TLS 1.1 succeeded

  3. 3.DMARC is in monitoring mode only (p=none)Medium

    dns.dmarc.policy-none

    TXT _dmarc.civilengineerjobs.net: v=DMARC1; p=none; rua=mailto:[masked]@dmarc-reports.cloudflare.net

  4. 4.Any certificate authority may issue certificates for this domainLow

    dns.caa.missing

    CAA civilengineerjobs.net: none

  5. 5.No WordPress, Joomla or Drupal detectedFor information

    cms.none

    No generator tag, known asset paths or login pages found

  6. 6.www.civilengineerjobs.net does not existFor information

    http.www.missing

    www.civilengineerjobs.net: DNS lookup failed (ENOTFOUND)

  7. 7.No DKIM key found under common namesFor information

    dns.dkim.not-found

    Checked selectors: google, selector1, selector2, default, k1 (no DKIM record)

  8. 8.Mail servers are configuredFor information

    dns.mx.present

    MX civilengineerjobs.net: 10 mx01.mail.icloud.com
MX civilengineerjobs.net: 10 mx02.mail.icloud.com

  9. 9.DNSSEC is not enabledFor information

    dns.dnssec.disabled

    DS civilengineerjobs.net: none

  10. 10.No common sensitive files are exposedGood

    exposure.files.none

    Checked 13 paths (/.git/HEAD, /.env, /.DS_Store, /backup.zip, /db.sql, /wp-config.php.bak, /phpinfo.php, /server-status, /.htaccess, /composer.json, /package.json, /debug.log, /wp-content/debug.log); baseline not-found status 404

  11. 11.Folder contents are not listed publiclyGood

    exposure.listing.none

    Checked /, /wp-content/uploads/, /uploads/

  12. 12.A security contact file (security.txt) is publishedGood

    exposure.security-txt.ok

    Contact: mailto:hi@civilengineerjobs.net
Expires: 2027-11-03T00:00:00.000Z

  13. 13.The HTTPS certificate is valid (76 days left)Good

    tls.cert.ok

    Subject: CN=civilengineerjobs.net
Issuer: C=US, O=Google Trust Services, CN=WE1
Valid: 2026-10-21T16:10:15.000Z to 2027-01-19T17:10:12.000Z (76 days left)
Names: DNS:civilengineerjobs.net, DNS:*.civilengineerjobs.net
Verification: trusted

  14. 14.The full certificate chain is servedGood

    tls.chain.ok

    0: CN=civilengineerjobs.net
   issued by C=US, O=Google Trust Services, CN=WE1
1: C=US, O=Google Trust Services, CN=WE1
   issued by C=US, O=Google Trust Services LLC, CN=GTS Root R4
2: C=US, O=Google Trust Services LLC, CN=GTS Root R4
   issued by C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA

  15. 15.Visitors are moved to the secure (HTTPS) versionGood

    http.redirect.ok

    http://civilengineerjobs.net/ -> https://civilengineerjobs.net/ (HTTP 301)

  16. 16.Browsers are told to always use HTTPSGood

    http.hsts.ok

    Strict-Transport-Security: max-age=31536000; includeSubDomains

  17. 17.A Content Security Policy restricts scriptsGood

    http.csp.ok

    Content-Security-Policy: default-src 'self'; script-src 'self' 'sha256-uwINJMttha16Tu37/7+7P/7n48mfuw6pdeCGYTi0xhA=' 'sha256-1MNMYnAxpRdkfag1srk1F09aicyIhJUh93IkIvh9HPM=' https://static.cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; connect-src 'self' https://cloudflareinsights.com; frame-src https://challenges.cloudflare.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://checkout.stripe.com; object-src 'none'; upgrade-insecure-requests

  18. 18.Browsers are told not to guess file typesGood

    http.nosniff.ok

    X-Content-Type-Options: nosniff

  19. 19.Other sites cannot embed this site in a frameGood

    http.clickjacking.ok

    X-Frame-Options: DENY; CSP frame-ancestors: 'none'

  20. 20.Referrer-Policy is setGood

    http.referrer-policy.ok

    Referrer-Policy: strict-origin-when-cross-origin

  21. 21.Permissions-Policy is setGood

    http.permissions-policy.ok

    Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), browsing-topics=()

  22. 22.No software versions announced in headersGood

    http.info-leak.ok

    Server: cloudflare

  23. 23.The homepage sets no cookiesGood

    http.cookies.none

    Set-Cookie: (none on the homepage)

  24. 24.SPF is set up correctlyGood

    dns.spf.ok

    TXT civilengineerjobs.net: v=spf1 include:icloud.com ~all
DNS lookups: 5

Checks that could not be completed

  • WordPress version: skipped (the site does not appear to use WordPress)
  • WordPress plugins and themes: skipped (the site does not appear to use WordPress)
  • WordPress user list and XML-RPC: skipped (the site does not appear to use WordPress)

Scope and method

Passive and non-intrusive: 24 automated checks using 25 ordinary web requests, plus public DNS lookups. No logins, form submissions or attack payloads. Performed with the site owner's permission.

This report is a point-in-time passive check, not a full penetration test. It looks only at what any visitor can see from the internet, using ordinary requests, at the date and time shown. It does not log in, test forms, or try to break in, so it cannot find every problem, and a clean result is not a guarantee of security. Websites change; we recommend repeating this check after changes and at least every few months.

Want a report like this for your site?

The audit covers headers, TLS, exposed files, outdated software, and email authentication.

About the auditRequest an audit