WebForensik
Results for https://webforensik.de/
Scan time: 2026-06-11 17:50:52
Overall Score
Score history for this domain View full history →
✔ This website meets basic data protection requirements.
Note: This automated analysis does not replace legal advice. For a complete GDPR assessment, consult a data protection officer.
↓ See detailed results for each category below.
The website uses an encrypted connection (HTTPS).
Latest encryption active (TLS 1.3 — TLSv1.3).
The security certificate is valid (expires 2026-10-07).
Strong encryption method (TLS_AES_256_GCM_SHA384, 256 bit).
HSTS is enabled — the browser is instructed to always use the encrypted connection.
HSTS duration: 31536000 seconds (at least 1 year) — very good.
HSTS also applies to all subdomains (includeSubDomains).
HSTS preload is enabled — browsers know about the encryption before the first visit.
Content Security Policy present (via HTTP-Header).
Script sources are properly restricted.
Additional protection through nonce or hash for scripts.
Embedding protection (frame-ancestors) is configured — protects against clickjacking.
Good base rule: only own content is allowed by default (default-src: self).
Referrer-Policy: no-referrer (via HTTP-Header).
Strict setting "no-referrer" — no path leak, no HTTP downgrade leak. Best practice.
MIME type protection active (nosniff) — browsers will not misinterpret files.
Clickjacking protection active via CSP frame-ancestors.
Permissions-Policy is configured — access to sensitive device APIs is controlled.
6 of 6 sensitive APIs restricted — very good.
1 first-party and 0 third-party cookie(s).
First-party cookies (from the website itself)
| Name | Domain | Encrypted | Server only | SameSite |
|---|---|---|---|---|
| WFSESSID | webforensik.de | Yes | Yes | Lax |
No local storage (Web Storage) used — no tracking risk.
No third-party requests detected — all content comes from the website's own server.
No known trackers detected.
No external scripts or stylesheets loaded.
No CAA records. Any certificate authority could issue a certificate for this domain.
▸ How to fix this — step-by-step guide
CAA records (Certification Authority Authorization) define in DNS which Certificate Authorities are allowed to issue certificates for your domain. Without a CAA record an attacker could request a fraudulent certificate for your domain at any CA. CAA is pure DNS configuration — set in your registrar/DNS-panel, NOT in WordPress.
☞ Concrete CAA values for the ten most common DACH-region hosts
Find your host in the table, copy the values to your DNS panel. For multi-CA hosts: one separate CAA record per CA (all with tag issue, flag 0, name @). Additionally recommended: an iodef record with a contact email for abuse reports.
| # | Host | CA(s) used | CAA value(s) — tag issue |
|---|---|---|---|
| 1 | Hetzner Webhosting (basic certificate, free in package) | DigiCert (programme „Encryption Everywhere") | digicert.com |
| 1 | Hetzner Webhosting (Let’s Encrypt, free) | Let’s Encrypt (ISRG) | letsencrypt.org |
| 2 | All-Inkl | Let’s Encrypt + Sectigo (Pro) | letsencrypt.orgsectigo.com |
| 3 | IONOS (1&1) | DigiCert (GeoTrust) + Let’s Encrypt | digicert.comletsencrypt.org |
| 4 | STRATO | Sectigo + Let’s Encrypt | sectigo.comletsencrypt.org |
| 5 | Cloudflare (Universal SSL) | Google Trust Services + DigiCert + Let’s Encrypt | pki.googdigicert.comletsencrypt.org |
| 6 | AWS (ACM / CloudFront) | Amazon Trust Services | amazon.comamazontrust.comawstrust.comamazonaws.com |
| 7 | Mittwald | Let’s Encrypt + Sectigo | letsencrypt.orgsectigo.com |
| 8 | Webgo | Let’s Encrypt + Sectigo | letsencrypt.orgsectigo.com |
| 9 | raidboxes (Managed WordPress) | Let’s Encrypt | letsencrypt.org |
| 10 | Host Europe / DomainFactory | Sectigo + Let’s Encrypt | sectigo.comletsencrypt.org |
Name Type Flag Tag Value
@ CAA 0 issue "digicert.com"
@ CAA 0 issue "letsencrypt.org"
@ CAA 0 iodef "mailto:security@your-domain.com"The iodef line (last line) is optional but recommended: CAs report abuse attempts to that address. For subdomains (e.g. shop.your-domain.com) create separate records with the subdomain name instead of @ — modern CAs check parent CAA automatically though.
If your host is not on the list: open your current certificate in the browser (padlock → certificate → issuer). The CA name is shown there (e.g. "Sectigo RSA Domain Validation Secure Server CA" → value sectigo.com). Add that as a CAA record, done.
WordPress Special for WordPress: where to add this
WordPress plugin: CAA records are NOT created in WordPress but in your domain registrar / DNS provider panel (e.g. Hetzner-Robot, IONOS Domains, Cloudflare Dashboard, INWX, etc.). Common label: "CAA record" or under "TXT records" with type selector "CAA". One separate record per CA.
✓ How to verify it works: On https://www.ssllabs.com/ssltest/analyze.html?d=your-domain.com → "DNS CAA" section → all your CAs should be listed. Or via dig: dig CAA your-domain.com.
2 nameservers present — good redundancy.
No IPv6 support (no AAAA record).
▸ How to fix this — step-by-step guide
Your domain has no IPv6 address (AAAA record). Over 40% of users (especially mobile) reach the internet via IPv6 — they must take the slower IPv4 gateway detour.
WordPress Special for WordPress: where to add this
WordPress plugin: Pure DNS + server matter. Step 1: check if your host has an IPv6 address for you (hosting panel or support ticket). Step 2: in the DNS panel create an AAAA record pointing to that IPv6. Step 3: test.
✓ How to verify it works: dig AAAA your-domain.com — or online https://ipv6-test.com/validate.php?url=your-domain.com.
No SPF record. Emails can be forged in the name of this domain.
▸ How to fix this — step-by-step guide
SPF (Sender Policy Framework) defines in DNS which servers may send emails on behalf of your domain. Without SPF any phisher can spoof emails from you — and recipients are more likely to fall for them.
WordPress Special for WordPress: where to add this
WordPress plugin: DNS matter, not WordPress. Create a TXT record in your DNS panel. Examples: If you send NO emails: v=spf1 -all (reject all senders). If only your host sends: v=spf1 a mx ~all. If Google Workspace: v=spf1 include:_spf.google.com ~all. If Microsoft 365: v=spf1 include:spf.protection.outlook.com -all.
✓ How to verify it works: dig TXT your-domain.com | grep spf — or online https://www.kitterman.com/spf/validate.html.
No DMARC record. The domain is vulnerable to email phishing.
▸ How to fix this — step-by-step guide
DMARC combines SPF and DKIM into an explicit instruction for receiving mail servers: "What to do if emails claim to come from us but SPF/DKIM fail?" Without DMARC each server decides — usually generously. With DMARC=reject you effectively prevent phishing in your name.
WordPress Special for WordPress: where to add this
WordPress plugin: DNS matter. TXT record at subdomain _dmarc.your-domain.com. Recommended stages: Observe first: v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain.com — review reports for weeks. Then tighten: v=DMARC1; p=quarantine; rua=… — suspicious mails go to spam. Final: v=DMARC1; p=reject; rua=… — they’re refused outright.
✓ How to verify it works: dig TXT _dmarc.your-domain.com — or online https://dmarcian.com/dmarc-inspector/.
security.txt found: https://webforensik.de/.well-known/security.txt
Contact field present (required) — security researchers can report vulnerabilities.
Expires field present (required).
Preferred languages specified.
No external reporting endpoints detected.
No consent banner needed — no trackers or third-party cookies detected.
Privacy policy linked: "Datenschutz" (https://nolte.pro/datenschutzerklaerung/).
Legal notice linked: "Impressum" (https://nolte.pro/impressum/).
Privacy policy page is accessible (HTTP 200).
| Header | Value |
|---|---|
| cache-control | no-store, no-cache, must-revalidate |
| connection | Keep-Alive |
| content-encoding | gzip |
| content-length | 6635 |
| content-security-policy | default-src 'self'; script-src 'self' 'nonce-dF2gfiCPvmqRmvbaIEPf/w=='; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests |
| content-type | text/html; charset=utf-8 |
| cross-origin-opener-policy | same-origin |
| cross-origin-resource-policy | same-origin |
| date | Thu, 11 Jun 2026 15:50:48 GMT |
| expires | Thu, 19 Nov 1981 08:52:00 GMT |
| keep-alive | timeout=15, max=100 |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=() |
| pragma | no-cache |
| referrer-policy | no-referrer |
| server | Apache |
| set-cookie | WFSESSID=d1d60774e977dbbd9af716b378b62349; path=/; secure; HttpOnly; SameSite=Lax |
| strict-transport-security | max-age=31536000; includeSubDomains; preload |
| vary | Accept-Encoding |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| x-permitted-cross-domain-policies | none |
Embed your score on your website
Show your WebForensik score publicly. The badge is a lightweight SVG, loads fast, and respects your visitors' privacy (no tracking).
HTML code to embed (this specific scan)
<a href="https://webforensik.de/results.php?id=145" target="_blank" rel="noopener">
<img src="https://webforensik.de/badge.php?id=145" alt="WebForensik Score" width="174" height="28">
</a>Or dynamically — always shows the latest scan of this domain
<a href="https://webforensik.de/?url=https://webforensik.de" target="_blank" rel="noopener">
<img src="https://webforensik.de/badge.php?domain=webforensik.de" alt="WebForensik Score" width="174" height="28">
</a>