PFProveFixed
Menu
How it worksFor agenciesSample reportPricing

Sample report

A client-ready report for Restaurante Demo.

This public sample uses static mock data only. It shows how a small business owner can understand the risk and how a technician can receive clear fix instructions.

Change the language to preview the existing report translation layer.

Scan your own websiteCreate free accountOpen dashboard

Client summary

Restaurante Demo needs website trust and email protection fixes.

Customer
Restaurante Demo
Domain
restaurante-demo.com
Report type
Public demo data
Next action
Send fix notes to technician

Score

45/100

Current website exposure score.

Risk level

Medium Risk

Several configuration items should be fixed before relying on the website and email domain for customer trust.

Executive summary

What the business owner should know

The site has a few configuration gaps that can affect trust, email delivery, or browser protection. These are usually fixable by the website host, developer, or email provider.

Business impact

Why this matters

  • Customers may see a less trusted version of the website.
  • Email fraud risk is harder to control without SPF and DMARC.
  • The technician has a clear fix list instead of vague security labels.

Evidence confidence

What is verified and what still needs proof

Every scanner result is separated into evidence confidence, public exposure, action priority, and verification status. Confidence describes evidence quality, not vulnerability severity.

A manual workflow status does not prove a fix. Only a successful follow-up observation can become Fixed and verified.

Confirmed issues

2

Need validation

3

Publicly observable

5

Fixed and verified

0

Fix today: 0Fix this week: 3More evidence: 0Schedule later: 2

Findings

Clear cards for the owner and technician

Each finding shows the business impact, likely responsible owner, fix effort, steps, and the exact message to copy.

5 need attention

Needs attention

Automatic HTTPS redirect

Missing

This checks whether visitors who type the old non-secure address are automatically moved to the secure website.

LikelyExternally observableFix this weekNot verified

Why this priority

  • Visitors may reach an unencrypted entry point before the secure site loads.
  • Evidence confidence is likely.
  • The signal was observable from the public scan path.

Priority score: 60/100. This is a workflow score, not a CVSS rating.

Stored evidence

Evidence limitations (1)
  • The stored scan record contains the redirect outcome but not the complete redirect chain.

Business impact

Without this redirect, some customers may land on a less trusted version of the site.

Responsible owner

Website host or web developer

Fix difficulty

Easy to medium | 15 minutes to 1 hour

Fix steps

  1. -Configure the website or hosting panel to redirect HTTP traffic to HTTPS.
  2. -Use a permanent redirect so bookmarks and search engines learn the secure address.
  3. -Test http:// and https:// versions after the change.

Technician message preview

Domain: restaurante-demo.com
Check: Automatic HTTPS redirect
Observed status: Missing

Configure a 301 redirect from HTTP to HTTPS at the CDN, host, web server, or application layer. Verify final URLs resolve to HTTPS.

Needs attention

Email sender authorization

Missing

This checks whether your domain says which services are allowed to send email for your business.

LikelyExternally observableSchedule laterNot verified

Why this priority

  • Missing SPF weakens sender authorization for the domain's email.
  • Evidence confidence is likely.
  • The signal was observable from the public scan path.

Priority score: 38/100. This is a workflow score, not a CVSS rating.

Stored evidence

The public scan observation returned Missing.

Source:
restaurante-demo.com
Value:
Missing
Observed:
25 Jun 2026, 11:30
Evidence limitations (1)
  • The stored scan record contains the DNS outcome but not the raw DNS answer used to produce it.

Business impact

Missing SPF can make real email less reliable and makes it easier for others to fake messages from your domain.

Responsible owner

Email provider or DNS administrator

Fix difficulty

Medium | 30 minutes to 2 hours

Fix steps

  1. -List the services that send email for the business.
  2. -Ask the email provider for the correct SPF record.
  3. -Publish or update the TXT record in DNS and avoid duplicate SPF records.

Technician message preview

Domain: restaurante-demo.com
Check: Email sender authorization
Observed status: Missing

Publish one SPF TXT record at the root domain. Include all approved mail senders and avoid multiple v=spf1 records.

Needs attention

Email impersonation policy

Missing

This checks whether your domain tells mail systems what to do when a message fails identity checks.

LikelyExternally observableFix this weekNot verified

Why this priority

  • Missing DMARC policy weakens the domain owner's control over email impersonation.
  • Evidence confidence is likely.
  • The signal was observable from the public scan path.

Priority score: 60/100. This is a workflow score, not a CVSS rating.

Stored evidence

The public scan observation returned Missing.

Source:
_dmarc.restaurante-demo.com
Value:
Missing
Observed:
25 Jun 2026, 11:30
Evidence limitations (1)
  • The stored scan record contains the DNS outcome but not the raw DNS answer used to produce it.

Business impact

Without DMARC, fake emails can be harder to control and customers may receive messages that appear to be from your business.

Responsible owner

Email provider or DNS administrator

Fix difficulty

Medium | 30 minutes to half a day

Fix steps

  1. -Create a DMARC record for the domain.
  2. -Start with monitoring if you are unsure which services send mail.
  3. -Review reports before moving to a stricter policy.

Technician message preview

Domain: restaurante-demo.com
Check: Email impersonation policy
Observed status: Missing

Publish a DMARC TXT record at _dmarc.domain. Start with p=none if sender inventory is incomplete, then progress to quarantine or reject after review.

Needs attention

Browser HTTPS memory

Missing

This checks whether browsers are told to remember that your site should use the secure version.

ConfirmedExternally observableSchedule laterNot verified

Why this priority

  • Missing HSTS leaves repeat visits without a browser-enforced HTTPS policy.
  • Evidence confidence is confirmed.
  • The signal was observable from the public scan path.

Priority score: 55/100. This is a workflow score, not a CVSS rating.

Stored evidence

strict-transport-security was not observed in the homepage response.

Value:
Not observed
Observed:
25 Jun 2026, 11:30

Business impact

Without this, repeat visitors have less protection if a network tries to downgrade their connection.

Responsible owner

Website host or web developer

Fix difficulty

Medium | 30 minutes to 2 hours

Fix steps

  1. -Confirm HTTPS works on the whole site.
  2. -Add the Strict-Transport-Security response header.
  3. -Test carefully before using long durations or preload settings.

Technician message preview

Domain: restaurante-demo.com
Check: Browser HTTPS memory
Observed status: Missing

Add Strict-Transport-Security after confirming HTTPS coverage. Start with a cautious max-age before considering includeSubDomains or preload.

Needs attention

Browser content rules

Missing

This checks whether your website gives browsers rules about where scripts, images, and other content may load from.

ConfirmedExternally observableFix this weekNot verified

Why this priority

  • A missing CSP removes a browser-side control that can reduce script injection impact.
  • Evidence confidence is confirmed.
  • The signal was observable from the public scan path.

Priority score: 65/100. This is a workflow score, not a CVSS rating.

Stored evidence

content-security-policy was not observed in the homepage response.

Value:
Not observed
Observed:
25 Jun 2026, 11:30

Business impact

A missing policy can make certain website mistakes more damaging, especially on sites with forms, booking tools, or customer data.

Responsible owner

Website developer

Fix difficulty

Medium to advanced | 2 hours to 1 day

Fix steps

  1. -Inventory scripts, forms, analytics, booking tools, and third-party widgets.
  2. -Create a Content Security Policy that allows trusted sources.
  3. -Test the site so legitimate features are not blocked.

Technician message preview

Domain: restaurante-demo.com
Check: Browser content rules
Observed status: Missing

Implement a Content-Security-Policy header based on actual asset and script sources. Test in report-only mode if needed before enforcing.

Before

Initial report

45/100

Missing email protection and browser safety headers created a practical trust and reputation risk.

After

Re-scan proof

82/100

SPF, DMARC, HTTPS redirect, and basic headers were fixed, so the follow-up report can show visible progress.

PDF report preview

Export a client-ready report.

Download a simple PDF generated from this mock report. Real saved reports can include your agency profile and can be used for client follow-up.

Secondary technical output

Original scanner results

The raw labels remain available for the technician, but the client report above is the primary experience.

SSL certificate

Confirms the website can be reached with a valid TLS certificate.

OK

HTTPS redirect

Checks whether HTTP visitors are automatically moved to HTTPS.

Missing

SPF record

Looks for sender authorization that helps prevent email spoofing.

Missing

DMARC record

Checks whether the domain publishes a policy for failed mail authentication.

Missing

HSTS header

Reviews whether browsers are told to keep using HTTPS on later visits.

Missing

Content Security Policy

Checks for browser rules that limit where scripts and content can load from.

Missing

Frame protection

Checks whether the site limits being embedded inside another page.

OK

Try it with your website

Turn your next scan into a report a client can use.

Public scanning remains available without login. Sign in when you want saved history, comparison, and client-ready PDFs.

Scan your own websiteCreate free accountOpen dashboard