What a real scan returns
This is an actual scan of datafolka.no, run on 2026-10-30. Header values, DNS records and certificate details are copied straight from the response. Nothing here is a mockup, and nothing was arranged in advance. What you see covers the header, TLS, DNS and cookie checks; the full category list is further down, so you can tell what this run measured from what the scanner also covers.
Why this domain and not ismycodesafe.com: a scanner grading itself proves nothing. datafolka.no belongs to the same person, runs a different stack, and is reachable so you can check the findings yourself. It is a reasonably hardened site, so this sample shows what a scan looks like when most things are already right, which is the harder case to read.
Confirmed issues
Things the scan proved from the response, not inferred.
DMARC enforcement
A05 Security MisconfigurationDMARC is published but set to p=none, so nothing is rejected
v=DMARC1; p=none; rua=mailto:postmaster@datafolka.no, mailto:dmarc@datafolka.no; pct=100; adkim=s; aspf=sp=none is monitoring only. Alignment is strict (adkim=s, aspf=s) and reports are being collected, so the groundwork is done, but a forged sender is still delivered. Move to p=quarantine once the reports show no legitimate sender failing.
Hardening gaps
Real, verified absences with lower impact. Kept separate so the list above stays honest.
Cross-Origin-Opener-Policy
A05 Security MisconfigurationHeader absent (6 of 7 present)
missing: ["Cross-Origin-Opener-Policy"]Without COOP a window opened from another origin can keep a reference to yours. Low impact on a site with no authenticated session, which is why it is listed here and not above.
CAA record
No CAA record published
caa: { present: false }Any certificate authority may issue for the domain. A CAA record limits that to the ones you use. Let's Encrypt is the current issuer, so the record would be short.
MTA-STS
No MTA-STS policy
mta_sts: { present: false }Mail senders fall back to opportunistic TLS, which can be stripped. Relevant because MX is live (smtp.google.com).
TLS-RPT
No TLS reporting policy
tls_rpt: { present: false }Without TLS-RPT there is no signal when mail delivery to the domain fails TLS. Pairs with MTA-STS.
What passed
Included because coverage is the thing a sample has to prove. A scan that only lists problems tells you nothing about what it looked at.
TLS certificate and protocol
Valid, TLSv1.3, expires 9 Jan 2027
issuer: Let's Encrypt (YR2), subject: datafolka.no, protocol: TLSv1.3Current protocol, 71 days of validity left at scan time. The scanner flags certificates inside 30 days.
Strict-Transport-Security
Present, two-year max-age
max-age=63072000Long enough to qualify for HSTS preload, though includeSubDomains and preload are not set.
Content-Security-Policy
Present, frame-ancestors 'none'
default-src 'self'; script-src 'self' 'unsafe-inline' https://analytics.ahrefs.com https://eu-assets.i.posthog.com; ... frame-ancestors 'none'Real policy rather than a placeholder. script-src still allows 'unsafe-inline', which the full report calls out as the next thing to remove.
X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
All four present
DENY / nosniff / strict-origin-when-cross-origin / geolocation=(), microphone=(), camera=()Clickjacking, MIME sniffing, referrer leakage and device access all covered.
SPF and DKIM
Both present and aligned
v=spf1 include:_spf.google.com ~all · dkim selectors: [google]Sender authentication is in place. Only the DMARC policy above is holding back enforcement.
Cookie attributes
No cookies set on first response
cookies_checked: 0, findings: []Nothing to misconfigure. Reported as zero rather than as a pass, so the number is not mistaken for a verified result.
Every category in the full scan
The findings above come from the headers, TLS, DNS and cookie checks. A full scan runs all of these, with CVE lookups against NVD and OSV for every detected technology:
What the paid report adds
The free scan shows what is wrong. The one-off report turns each finding into a fix you can hand to a developer, with a CVSS score and its OWASP Top 10 category, ordered by what to do first. The AI-written parts are disclosed as such, because a fix plan you cannot audit is worth less than one you can.
Scans are external and read-only. Nothing is exploited and no payload is sent. Only scan sites you own or have permission to scan. Run by Roy Morken.