abmans.com

Security

I study security, so this site gets inspected out loud. Press the button and your browser checks the real settings, live. Nothing is pre-filled.

Inspection

Certificate of inspection

Six checks on abmans.com. A stamp says what was found, including when something is missing.

  • Sender policy (SPF)

    Lists which servers may send mail as abmans.com, so forged mail is easier to spot.

    Not run

  • Spoofing policy (DMARC)

    Tells receiving mail servers what to do with mail that fails the sender checks.

    Not run

  • DNS signatures (DNSSEC)

    Signs the domain's DNS records so a fake answer can be detected.

    Not run

  • Certificate authorities (CAA)

    Limits which authorities may issue HTTPS certificates for the domain.

    Not run

  • Forced HTTPS (HSTS)

    Tells browsers to refuse plain HTTP connections to this site.

    Not run

  • Browser protections

    Reads this page's own response headers: content policy, framing, sniffing, referrer and isolation.

    Not run

Not inspected yetNothing is checked until you press the button.

Running this sends four DNS lookups for abmans.com to Cloudflare's public resolver (cloudflare-dns.com) from your browser, and one request back to this site. It does not send anything about you. A stamp of "Unknown" means a check could not complete, not that it failed.

How this site is built

  • No third-party code

    Every script, style and font is served from this site. There are no trackers, analytics, cookies or embedded widgets.

  • A content policy that blocks injected scripts

    The policy only allows files from this origin, forbids inline scripts and styles, and blocks framing, plugins and form posts. Even if markup were injected, it could not run.

  • Trusted Types

    Browsers that support it refuse to run anything that writes raw HTML or evaluates strings. The site's code never does either, and Trusted Types is set to allow no policies at all.

  • Static pages only

    There is no server code, database, login or form. The contact route is an email address, which keeps the attack surface close to nothing.

  • HTTPS enforced, isolated from other sites

    Strict transport security, same-origin opener and resource policies and a locked-down permissions policy are sent on every response.

  • A way to report problems

    A security.txt file lists how to reach me if you find something.

Honest limits: the inspection covers the settings above, not everything. It cannot prove the site is free of flaws, and the browser check only reads headers the browser can see.