Loading...
Loading...
Comprehensive security assessment of the web infrastructure
Let's Encrypt is provided automatically by Vercel, which is standard and appropriate.
Certificate type: DV certificates only validate domain ownership, not organizational identity. For a B2B company asking customers to submit quote requests (potentially containing business-sensitive information like volumes, pricing expectations, company details), an Organization Validation (OV) or Extended Validation (EV) certificate would provide stronger trust signals.
However: The practical security of the TLS connection is identical regardless of certificate type. The difference is primarily in trust indicators. Modern browsers have largely de-emphasized EV visual indicators, reducing this concern.
✓ Positive finding
HSTS ensures that:
includeSubDomains directive set? This would protect all subdomains.31536000 seconds (1 year).The redirect to www subdomain is a design choice (some prefer apex domain). The key issue is whether both directions are handled correctly and consistently, and whether HSTS covers both.
ETags are used for cache validation. A weak ETag (prefixed with W/) indicates semantic equivalence rather than byte-for-byte identity.
The profile does not mention several critical security measures. Their absence from this report doesn't necessarily mean they're not implemented, but they warrant verification:
| Security Measure | Status | Risk if Missing |
|---|---|---|
| Content Security Policy (CSP) | Not mentioned | High — XSS vulnerability exposure |
| X-Content-Type-Options | Not mentioned | Medium — MIME sniffing attacks |
| X-Frame-Options / CSP frame-ancestors | Not mentioned | Medium — Clickjacking |
| Referrer-Policy | Not mentioned | Medium — Information leakage |
| Permissions-Policy | Not mentioned | Low-Medium — Feature abuse |
| Subresource Integrity (SRI) | Not mentioned (critical given CDNJS usage) | High — Supply chain attack |
| DNSSEC | Not mentioned | Medium — DNS spoofing |
| WAF (Web Application Firewall) | Not mentioned | Medium-High — Application-layer attacks |
| Rate limiting | Not mentioned | Medium — Brute force, scraping |
The site uses CDNJS (Cloudflare) for JavaScript library delivery. Loading third-party JavaScript from an external CDN introduces a supply chain attack vector. If CDNJS were compromised (or a specific library on it), malicious code could be injected into the site.
Subresource Integrity (SRI) hashes must be implemented on all <script> and <link> tags loading from CDNJS to mitigate this risk. This is a high-priority security concern.