B86 / 100

Inspection record

yogalandia.com

2026-10-24 22:03 UTC · 0.2s · 19 checks

This domain is in good shape. The checks below are the few things worth keeping an eye on.

Not an official certification. This grade covers only a few externally visible components and is not a security audit. A high grade does not mean a domain is secure. Terms

1failing8warnings15passing8not gradeable

Stable link for yogalandia.com →

Email authentication

W 35100

DNS

W 1270

TLS & certificate

W 20100

HTTP headers

W 2564

What to fix first

B 86 → A 100

Ordered by how many points each fix adds to the score. Fixing everything would take this domain from B to A. Re-scan afterwards to confirm.

1.
DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.
Enable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.
Warn · DNS
+3 pts
2.
No Content-Security-Policy. Nothing constrains which scripts the page may execute, so any injected script runs.
Start with a report-only policy to find violations, then enforce. Even `default-src 'self'` is a large improvement over nothing.
Fail · HTTP headers
+2 pts
3.
No Permissions-Policy. Embedded third-party frames can request camera, microphone, geolocation and other powerful features unless you deny them.
Send `Permissions-Policy: camera=(), microphone=(), geolocation=()`, then allow only what the site uses.
Warn · HTTP headers
+2 pts
4.
No security.txt. Someone who finds a vulnerability has no documented way to tell you.
Publish https://yogalandia.com/.well-known/security.txt with at least a Contact: and an Expires: field (RFC 9116).
Warn · HTTP headers
+2 pts
5.
CAA has no `iodef` address, so you are not notified when a CA is asked to issue a certificate it should not.
Add: 0 iodef "mailto:security@yogalandia.com".
Warn · DNS
+1 pts
6.
HSTS does not include subdomains, so subdomains can still be reached over plaintext HTTP.
Add `includeSubDomains` once every subdomain is confirmed to serve HTTPS.
Warn · HTTP headers
+1 pts
7.
Neither `frame-ancestors` nor X-Frame-Options is set, so the site can be framed for clickjacking.
Add `frame-ancestors 'none'` to the Content-Security-Policy.
Warn · HTTP headers
+1 pts
8.
No `X-Content-Type-Options: nosniff`, so browsers may guess content types and execute an upload as script.
Send `X-Content-Type-Options: nosniff`.
Warn · HTTP headers
+1 pts
9.
No Referrer-Policy, so full URLs (including any tokens in them) leak to third-party sites.
Send `Referrer-Policy: strict-origin-when-cross-origin`.
Warn · HTTP headers
+1 pts

Email authentication

Weight 35 · Score 100

Whether someone can send mail pretending to be this domain.

DMARC

email.dmarc

Pass

DMARC policy is `p=reject`.

v=DMARC1; p=reject

SPF

email.spf

Pass

SPF ends in `-all`, rejecting mail from unlisted senders.

v=spf1 -all

Pass

SPF uses 0 of 10 permitted DNS lookups.

DKIM

email.dkim

Info

No DKIM key found at any commonly-used selector. Selectors cannot be enumerated from DNS, so this does not prove DKIM is absent — check with your mail provider.

MTA-STS

email.mta_sts

Info

MTA-STS does not apply: this domain accepts no mail, so there is no inbound delivery to protect.

TLS reporting

email.tls_rpt

Info

TLS-RPT does not apply: this domain accepts no mail, so there is no inbound delivery to protect.

Mail servers

email.mx

Pass

Null MX published: this domain explicitly declares that it accepts no mail.

0 .

DNS

Weight 12 · Score 70

Integrity and issuance controls on the domain's DNS records.

DNSSEC

dns.dnssec

Warn

DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.

FixEnable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.

CAA

dns.caa

Pass

CAA records restrict issuance to: pki.goog, sectigo.com, letsencrypt.org.

0 issue "pki.goog", 0 issue "sectigo.com", 0 issue "letsencrypt.org"

Warn

CAA has no `iodef` address, so you are not notified when a CA is asked to issue a certificate it should not.

FixAdd: 0 iodef "mailto:security@yogalandia.com".

Nameservers

dns.ns

Pass

2 nameserver(s).

ns2.vercel-dns.com, ns1.vercel-dns.com

TLS & certificate

Weight 20 · Score 100

The certificate and the encryption used to serve the site.

Certificate

tls.certificate

Pass

Certificate valid for another 83 day(s).

Let's Encrypt, notAfter 2027-01-16T16:06:33.000Z

Pass

Certificate covers yogalandia.com.

Pass

The certificate chain validates against the public trust roots.

Pass

Negotiated TLSv1.3.

TLS_AES_128_GCM_SHA256

Connection strength

tls.strength

Pass

The connection uses forward secrecy, so recorded traffic stays private even if the server key is later stolen.

TLSv1.3, TLS_AES_128_GCM_SHA256

Pass

The server supports TLS 1.3.

TLSv1.3, TLS_AES_128_GCM_SHA256

Deprecated protocol versions

tls.legacy_protocols

Pass

TLS 1.0 and 1.1 are refused, so only current protocol versions are accepted.

HSTS preload

tls.hsts_preload

Info

The domain is not on the HSTS preload list. Preloading is optional and hard to undo; most sites do not need it.

HTTP headers

Weight 25 · Score 64

Response headers that constrain what a browser will do, and how a researcher can reach you about a problem.

Security headers

headers.security

Pass

HSTS is set with a long max-age.

max-age=63072000

Warn

HSTS does not include subdomains, so subdomains can still be reached over plaintext HTTP.

max-age=63072000

FixAdd `includeSubDomains` once every subdomain is confirmed to serve HTTPS.

Fail

No Content-Security-Policy. Nothing constrains which scripts the page may execute, so any injected script runs.

FixStart with a report-only policy to find violations, then enforce. Even `default-src 'self'` is a large improvement over nothing.

Warn

Neither `frame-ancestors` nor X-Frame-Options is set, so the site can be framed for clickjacking.

FixAdd `frame-ancestors 'none'` to the Content-Security-Policy.

Warn

No `X-Content-Type-Options: nosniff`, so browsers may guess content types and execute an upload as script.

FixSend `X-Content-Type-Options: nosniff`.

Warn

No Referrer-Policy, so full URLs (including any tokens in them) leak to third-party sites.

FixSend `Referrer-Policy: strict-origin-when-cross-origin`.

HTTPS redirect

headers.https_redirect

Pass

HTTP redirects to HTTPS (308).

https://yogalandia.com/

Cookies

headers.cookies

Info

No cookies were set on the homepage response.

Browser hardening headers

headers.hardening

Warn

No Permissions-Policy. Embedded third-party frames can request camera, microphone, geolocation and other powerful features unless you deny them.

FixSend `Permissions-Policy: camera=(), microphone=(), geolocation=()`, then allow only what the site uses.

Info

No Cross-Origin-Opener-Policy. Pages that open or are opened by cross-origin windows keep a handle on each other, which cross-site leak attacks use.

FixConsider `Cross-Origin-Opener-Policy: same-origin` if the site does not rely on cross-origin popups.

Info

Neither Cross-Origin-Resource-Policy nor Cross-Origin-Embedder-Policy is set, so other sites may load this response as a sub-resource.

FixConsider `Cross-Origin-Resource-Policy: same-origin` for responses that are not meant to be embedded.

CORS

headers.cors

Info

No CORS headers on the homepage response, so cross-origin reads follow the browser default (blocked).

security.txt

headers.security_txt

Warn

No security.txt. Someone who finds a vulnerability has no documented way to tell you.

FixPublish https://yogalandia.com/.well-known/security.txt with at least a Contact: and an Expires: field (RFC 9116).

For the owner of yogalandia.com

Show your grade

Put this badge on your homepage. It links to this report, and when a scan finds it on your site the report is marked verified, so visitors know the grade is yours.

The badge is not an official certification and not a security audit. It reflects only a few external checks, so don’t present it as proof of security or compliance. See the terms.

For light sitesFor dark sites

Paste into your homepage HTML

<a href="https://surface.darinor.com/d/yogalandia.com"><img src="https://surface.darinor.com/badge/yogalandia.com.svg" alt="Security grade for yogalandia.com by Surface" height="44"></a>

I've added it: scan again

Publish the change first, then scan again. Surface looks for the badge on https://yogalandia.com/ every time it scans. Reports are reused for 15 minutes, so a scan right after the last one may show the earlier result. The badge image can take up to an hour to show a new grade.

Surface keeps only the latest report for each domain. Re-inspecting yogalandia.com will replace this report, and this link will stop resolving — use the stable link above if you want a URL that always reflects the current state.