{
  "data": {
    "slug": "3156afa5",
    "url": "https://kst.inger.sk",
    "domain": "kst.inger.sk",
    "overall_score": 70,
    "scores_json": {
      "seo": {
        "score": -1,
        "checks": [
          {
            "name": "SEO",
            "value": "Website Unreachable (HTTP 401) — Client error (401). The URL may be invalid or access is restricted.",
            "status": "info",
            "howToFix": "Ensure the website is accessible and not blocking automated requests.",
            "whyMatters": ""
          }
        ]
      },
      "gdpr": {
        "score": -1,
        "checks": [
          {
            "name": "GDPR",
            "value": "Website Unreachable (HTTP 401) — Client error (401). The URL may be invalid or access is restricted.",
            "status": "info",
            "howToFix": "Ensure the website is accessible and not blocking automated requests.",
            "whyMatters": ""
          }
        ]
      },
      "nis2": {
        "score": -1,
        "checks": [
          {
            "name": "NIS2 Compliance",
            "value": "Website Unreachable (HTTP 401) — Client error (401). The URL may be invalid or access is restricted.",
            "status": "info",
            "howToFix": "Ensure the website is accessible and not blocking automated requests.",
            "whyMatters": ""
          }
        ]
      },
      "mobile": {
        "score": -1,
        "checks": [
          {
            "name": "Mobile",
            "value": "Website Unreachable (HTTP 401) — Client error (401). The URL may be invalid or access is restricted.",
            "status": "info",
            "howToFix": "Ensure the website is accessible and not blocking automated requests.",
            "whyMatters": ""
          }
        ]
      },
      "modules": [],
      "security": {
        "score": 52,
        "checks": [
          {
            "i18n": {
              "key": "sec.ssl.pass"
            },
            "name": "SSL/TLS Certificate",
            "value": "Valid HTTPS connection established",
            "status": "pass",
            "evidence": {
              "source": "SSL"
            }
          },
          {
            "i18n": {
              "key": "sec.dnssec.warning"
            },
            "name": "DNSSEC",
            "value": "No DNSKEY records — zone is unsigned",
            "status": "warning",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "DNSSEC setup help →"
            },
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.",
            "whyMatters": "Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities."
          },
          {
            "i18n": {
              "key": "sec.caa.warning"
            },
            "name": "CAA DNS Record",
            "value": "No CAA records — any CA can issue certificates for this domain",
            "status": "warning",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue \"letsencrypt.org\"`. For multiple CAs add additional `0 issue \"...\"` records. Add `0 iodef \"mailto:security@yourdomain.tld\"` for misissuance reports.",
            "whyMatters": "CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017)."
          },
          {
            "i18n": {
              "key": "sec.https-redirect.pass"
            },
            "name": "HTTP → HTTPS Redirect",
            "value": "HTTP properly redirects to HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.hsts.fail"
            },
            "name": "HSTS (Strict-Transport-Security)",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.",
            "whyMatters": "Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi."
          },
          {
            "i18n": {
              "key": "sec.csp.fail"
            },
            "name": "Content-Security-Policy (CSP)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Security Hardening →"
            },
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.",
            "whyMatters": "CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection."
          },
          {
            "i18n": {
              "key": "sec.clickjacking.fail"
            },
            "name": "Clickjacking Protection",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.",
            "whyMatters": "Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it."
          },
          {
            "i18n": {
              "key": "sec.x-content-type.warning"
            },
            "name": "X-Content-Type-Options",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: X-Content-Type-Options: nosniff",
            "whyMatters": "Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it."
          },
          {
            "i18n": {
              "key": "sec.referrer-policy.warning"
            },
            "name": "Referrer-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.",
            "whyMatters": "Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths."
          },
          {
            "i18n": {
              "key": "sec.permissions-policy.warning"
            },
            "name": "Permissions-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.",
            "whyMatters": "Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge."
          },
          {
            "i18n": {
              "key": "sec.cookie-flags.pass-none"
            },
            "name": "Cookie Security Flags",
            "value": "No cookies set on initial response",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.tech-disclosure.pass",
              "params": {
                "detail": "Caddy"
              }
            },
            "name": "Technology Disclosure",
            "value": "Server: Caddy (no version)",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.security-txt.warning"
            },
            "name": "security.txt (RFC 9116)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.",
            "whyMatters": "security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all."
          },
          {
            "i18n": {
              "key": "sec.cdn.warning"
            },
            "name": "CDN / WAF Protection",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.",
            "whyMatters": "Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts."
          }
        ]
      },
      "tech_stack": [],
      "fetch_error": true,
      "http_status": 401,
      "performance": {
        "score": -1,
        "checks": [
          {
            "name": "Performance",
            "value": "Website Unreachable (HTTP 401) — Client error (401). The URL may be invalid or access is restricted.",
            "status": "info",
            "howToFix": "Ensure the website is accessible and not blocking automated requests.",
            "whyMatters": ""
          }
        ]
      },
      "ai_readiness": {
        "score": -1,
        "checks": [
          {
            "name": "AI Readiness",
            "value": "Website Unreachable (HTTP 401) — Client error (401). The URL may be invalid or access is restricted.",
            "status": "info",
            "howToFix": "Ensure the website is accessible and not blocking automated requests.",
            "whyMatters": ""
          }
        ]
      },
      "accessibility": {
        "score": -1,
        "checks": [
          {
            "name": "Accessibility / EAA",
            "value": "Website Unreachable (HTTP 401) — Client error (401). The URL may be invalid or access is restricted.",
            "status": "info",
            "howToFix": "Ensure the website is accessible and not blocking automated requests.",
            "whyMatters": ""
          }
        ]
      },
      "vulnerability": {
        "score": 96,
        "checks": [
          {
            "i18n": {
              "key": "vuln.cms-version.pass"
            },
            "name": "CMS Version Disclosure",
            "value": "No generator tag — CMS identity hidden",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.sensitive-files.pass"
            },
            "name": "Sensitive Files Exposed",
            "value": ".env, .git, composer.json — all properly blocked",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.install-script.pass"
            },
            "name": "Install Script Exposed",
            "value": "No /install/ or /setup/ paths accessible",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.directory-listing.pass"
            },
            "name": "Directory Listing",
            "value": "Disabled — file structure hidden",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.admin-url.pass"
            },
            "name": "Admin Panel at Default URL",
            "value": "Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.debug-mode.pass"
            },
            "name": "Debug Mode / Error Exposure",
            "value": "No debug indicators found in page output",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.spf.info-nomx"
            },
            "name": "SPF Record (Email Security)",
            "value": "No SPF record, and no MX — this domain doesn't send/receive email, so deliverability isn't affected",
            "status": "info",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Even a non-sending domain should block spoofing: publish an explicit null-sending SPF record — v=spf1 -all — so no server can forge mail as this domain.",
            "confidence": "low",
            "whyMatters": "Attackers spoof unprotected domains (even ones that never send email) in phishing. A hard-fail SPF (v=spf1 -all) plus DMARC p=reject stops your domain being used to impersonate you — this is the M3AAWG/NCSC guidance for non-sending domains."
          },
          {
            "i18n": {
              "key": "vuln.dmarc.info-nomx"
            },
            "name": "DMARC Policy (Email Auth)",
            "value": "No DMARC record, and no MX — this domain doesn't handle email, so deliverability isn't affected",
            "status": "info",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Publish an anti-spoofing DMARC record even on a non-sending domain: at _dmarc.yourdomain.com set v=DMARC1; p=reject; — paired with SPF v=spf1 -all it prevents your domain being forged in phishing.",
            "confidence": "low",
            "whyMatters": "Domains with no email are still spoofed by attackers. A DMARC p=reject (with SPF -all) tells receivers to drop any mail claiming to be from this domain — closing the impersonation vector without affecting any real mail (there is none)."
          },
          {
            "i18n": {
              "key": "vuln.email-infra.info"
            },
            "name": "Email Infrastructure",
            "value": "No MX records — domain does not receive email",
            "status": "info",
            "evidence": {
              "source": "DNS"
            }
          },
          {
            "i18n": {
              "key": "vuln.cross-origin.warning"
            },
            "name": "Cross-Origin Isolation",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.",
            "whyMatters": "Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers."
          }
        ]
      },
      "fetch_error_message": "Client error (401). The URL may be invalid or access is restricted."
    },
    "created_at": "2026-07-23T11:59:25.989824+00:00",
    "status": "complete",
    "platform_detected": null,
    "company_ico": null,
    "company_name": null,
    "company_country": null,
    "company_nace": null,
    "company_size": null,
    "nis2_scope": null,
    "nis2_sector": null,
    "company_risk_score": null,
    "company_risk_level": null
  }
}