Skip to content
isyoursitesafe
Menu

Report format

What a report looks like.

This page shows the format every report follows. The findings below are examples written to show the layout. They are not from a real scan, and yourbusiness.example is not a real website.

The real anonymized sample report is published after we scan our own sites, before launch (pre-launch gates G3 and G4).

Report header

Example layout
Scope
https://yourbusiness.example and the hosts its DNS names (example)
Method
Safe Profile, check-set v1.0; passive and single-request checks unless you opted in to more
Limitations
Point-in-time: true when the scan ran, not a promise about tomorrow. No logins, no exploitation, no load testing.
Scan hash
[hash of the evidence bundle appears here in a real report]

Findings

Each finding runs in the same order: the risk in one plain sentence, severity and why, proof, the fix you can do yourself, an effort estimate, and our price if you would rather we did it.

Check 32 · Example, not a real scan

Critical

.env file can be downloaded

The risk
Anyone can download a file that holds your site's passwords and keys.
Severity and why
Critical because the file can hand over your database and email accounts without any further hacking.
Proof
GET https://yourbusiness.example/.env returned the file. Contents redacted in the report; the raw response is kept in the evidence bundle.
Fix it yourself
  1. Delete the file from the web root.
  2. Block dotfiles in your server or host settings.
  3. Change every password and key the file contained.
Effort estimate
Up to 8 hours, the cap for this fix on our menu. A real report estimates each finding on its own.
If we do it
Leaked secret rotation: $499, closed with a re-scan that shows it worked.

Check 6 · Example, not a real scan

Medium

DMARC policy is set to none

The risk
Anyone can send email that claims to come from your domain, and mail servers are told to deliver it anyway.
Severity and why
Medium because it enables invoice fraud in your name, but nothing on your website is exposed.
Proof
_dmarc.yourbusiness.example TXT "v=DMARC1; p=none"
Fix it yourself
  1. Read your DMARC aggregate reports to see who sends mail as you.
  2. Fix SPF and DKIM for each real sender.
  3. Raise the policy to quarantine, then to reject.
Effort estimate
Up to 2 hours, the cap for this fix on our menu. A real report estimates each finding on its own.
If we do it
SPF and DMARC: $149, closed with a re-scan that shows it worked.

Check 22 · Example, not a real scan

Low

No Content-Security-Policy header

The risk
If someone slips a script into your pages, the browser has no rule telling it to refuse.
Severity and why
Low on its own; it raises the damage of any other injection bug.
Proof
Response headers for https://yourbusiness.example/ contain no Content-Security-Policy.
Fix it yourself
  1. Start with a report-only policy.
  2. List the scripts your site really loads.
  3. Switch the policy to enforce.
Effort estimate
Up to 3 hours, the cap for this fix on our menu. A real report estimates each finding on its own.
If we do it
Security headers and CSP: $199, closed with a re-scan that shows it worked.

Want us to do this? Each finding ends with its own pay link at the menu price. Real reports carry working links; this example has none.

Every report ships three ways: a human report (HTML and PDF), an agent file (JSON) and SARIF for developer tools.

See the full fix menu