GRC Oversight
Guide

Scanner remediation guide

What the free website scan actually checks, and how to fix what it finds, organized the same way the scan itself is scored.

TLS / certificate

  • Renew certificates before they expire: the scan flags a shrinking days-until-expiry window well ahead of an actual lapse.
  • Move off legacy TLS protocols; modern TLS versions are what the scan expects to see negotiated.
  • Use a certificate from a trusted chain: a self-signed or untrusted-chain cert is flagged directly.

HTTP security headers

  • Set Strict-Transport-Security with a max-age of at least ~180 days; a short max-age is present but still scores poorly, so length matters.
  • Add a Content-Security-Policy: its absence is one of the larger scoring penalties.
  • Set X-Content-Type-Options: nosniff, a restrictive X-Frame-Options (or frame-ancestors in your CSP), a Referrer-Policy, and a Permissions-Policy.

DNS hygiene

  • Publish an SPF record so mail claiming to be from your domain can be validated.
  • Publish a DMARC record, and move its policy beyond monitor-only (p=none) once you trust your SPF/DKIM setup.
  • Add a DKIM record at the selector your mail provider uses.
  • Add a CAA record to restrict which certificate authorities can issue for your domain.
  • Consider DNSSEC if your registrar and DNS provider support it.

Cookies & consent

  • Set the Secure flag on every cookie so it's never sent over plain HTTP.
  • Set HttpOnly on cookies that don't need JavaScript access, to limit XSS exposure.
  • Set a restrictive SameSite value instead of leaving it default or None.
  • If you set cookies before any consent interaction, that's flagged directly: align cookie-setting with your actual consent banner.

Mixed content & exposure

  • Serve every subresource over HTTPS on an HTTPS page: even one http:// request is flagged as mixed content.
  • Make sure .git and .env are not reachable at your site root: either is a serious, directly-flagged exposure.
  • Publish a /.well-known/security.txt: its presence is scored as a positive signal, not just its absence as a gap.

Accessibility

  • The scan runs an automated accessibility pass (axe-core) on the page as loaded: it catches machine-detectable issues, not full manual WCAG conformance.
  • Prioritize violations by impact and how many elements they affect: that's exactly how the score is weighted.
  • Automated results don't replace a manual accessibility review; treat this as a first pass, not a certification.

What the scanner never does

  • It performs passive, browser-equivalent checks only: one page load, the same requests a normal visitor's browser would make.
  • It doesn't attempt exploitation, brute force, or anything beyond a single GET for the exposure checks.
  • It won't scan a private, internal, or loopback address: targets are validated before anything runs.

Run the scan again after you fix these to see the score and findings change.