This is a sample report with illustrative, fictional findings. It does not reflect any real website.

Sample scan result

Scanned: https://example.com - sample data only

3 things to look at · 2 already good. Want step-by-step fixes plus a free recheck? Get my fix - $5.

• Fix soonUsually a 5-minute fix for your web host or developer, once HTTPS is confirmed working everywhere.

  Your site doesn't force browsers to stick with a secure connection

  Why it matters: Without this instruction, a visitor could be tricked onto an unprotected version of your site, exposing whatever they send to it.

  Even if your site supports a secure connection, it isn't telling visitors' browsers to always use it. That's like having a lock on the door but leaving a note that it's optional to use.

  What could happen: A visitor could get tricked onto an unprotected copy of your site without ever noticing the difference.

  Your step-by-step fixUnlocks with Get my fix
  Technical details (for your developer)

  Technical name: HTTP Strict Transport Security

  Checks for a Strict-Transport-Security response header on the HTTPS connection and parses max-age/includeSubDomains/preload. Missing HSTS is a hardening gap, not proof of an active breach.

  Severity: Medium (90% confidence)

  Location: https://example.com/

  Evidence: No Strict-Transport-Security header observed.

• Fix nowUsually a 15-30 minute fix for your developer, since it touches how your site manages logins.

  Your site's cookies aren't fully locked down

  Why it matters: A loosely secured cookie - especially one that keeps someone logged in - can let an attacker impersonate a customer or an admin.

  Cookies are small bits of data your site stores in a visitor's browser, often to keep them logged in. Some of yours are missing settings that keep them from being read over an unsecured connection or shared with other sites.

  What could happen: Someone on the same Wi-Fi could grab a customer's login cookie and sign in as them without a password.

  Your step-by-step fixUnlocks with Get my fix
  Technical details (for your developer)

  Technical name: Cookie Secure/HttpOnly/SameSite flags

  Checks Secure, HttpOnly and SameSite attributes on cookies actually observed in public responses, and flags cookies whose name suggests a session/auth cookie more severely. Known CSRF double-submit token cookies (e.g. XSRF-TOKEN, csrftoken, _csrf) are never treated as session cookies and are never expected to carry HttpOnly, since frameworks require them to be readable by client-side JavaScript. Makes no assumption about cookies set only after authentication.

  Severity: High (70% confidence)

  Location: https://example.com/ (session cookie)

  Evidence: sessionid=***** (Secure, HttpOnly not set)

• Fix nowFix this now: have your developer confirm it, rotate/revoke it with the provider right away, then remove it from the public file.

  A private key or password-like credential may be exposed

  Why it matters: If this turns out to be a real, active credential, anyone who finds it could access your accounts, data or services as if they were you.

  Something on your site's public pages or scripts looks like a real private key, password or access token - information that should only ever live on your server, never in files a visitor's browser can see.

  What could happen: Someone who finds this key could use your account and run up charges in your name.

  Urgent: Rotate/revoke this credential with the provider right away, then remove it from the public file.

  Your step-by-step fixUnlocks with Get my fix
  Technical details (for your developer)

  Technical name: Exposed credential indicators in public HTML/JS

  Checks publicly retrieved HTML and same-origin JavaScript for patterns that resemble known provider private-credential formats (AWS, GitHub, Stripe secret keys, Slack tokens, PEM private key blocks). Matches are suspected only; SiteSignal never attempts to use or validate a credential. Google API keys are checked separately (see `google-api-key-note`) since they are commonly public-by-design.

  Severity: Critical (95% confidence)

  Location: https://example.com/assets/app.js

  Evidence: AKIA**************** (masked)

The paid Get my fix - $5 package adds a step-by-step fix checklist tailored to how your site is built, a small downloadable PDF, and one recheck within 7 days.