Automatic security check · Public OSINT only
Scanned URL
netlify.com security check
Public OSINT valuation for netlify.com: grade C (59/100). Title signal “Push your ideas to the web | Netlify”. 2 security headers present, 6 commonly expected headers missing. This is a defensive surface review — not a penetration test.
59
/100
Grade C
- High concern
- Elevated risk
- Caution advised
- Trusted — verify
- Strong protections
How we scored netlify.com
Positive signals
- TLS handshake OK (TLSv1.3).
- HTTP Strict Transport Security is present.
- DNS resolves publicly (A/AAAA).
- robots.txt is publicly available.
- RDAP domain record available (netlify.com).
- Final HTTP status 200 at https://www.netlify.com/.
Risk signals
- Content-Security-Policy not observed.
- X-Content-Type-Options missing.
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
Findings
- TLS handshake OK (TLSv1.3).
- HTTP Strict Transport Security is present.
- Content-Security-Policy not observed.
- X-Content-Type-Options missing.
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
- DNS resolves publicly (A/AAAA).
- robots.txt is publicly available.
- RDAP domain record available (netlify.com).
- Final HTTP status 200 at https://www.netlify.com/.
Technical details
DNS
resolved- A
- 3.33.186.135, 15.197.167.90
- AAAA
- 2a05:d014:58f:6200::1f5, 2a05:d014:58f:6200::1f6
- PTR
- afa7f374f51cc8991.awsglobalaccelerator.com
- error
- —
TLS / certificate
ok- version
- TLSv1.3
- cipher
- TLS_AES_128_GCM_SHA256
- issuer
- DigiCert Inc
- notAfter
- Feb 5 23:59:59 2027 GMT
- SAN sample
- netlify.com, bitballoon.com, netlifyglobalcdn.com, *.netlify.com, *.bitballoon.com, *.netlifyglobalcdn.com
- error
- —
HTTP & security headers
2 present- finalUrl
- https://www.netlify.com/
- status
- 200
- server
- Netlify
- x-powered-by
- —
- present
- permissions-policy, strict-transport-security
- missing
- content-security-policy, x-content-type-options, x-frame-options, referrer-policy, cross-origin-opener-policy, cross-origin-resource-policy
- cookie Secure
- True
- cookie HttpOnly
- False
Tech fingerprint (public)
passive- title
- Push your ideas to the web | Netlify
- generator
- Astro v7.3.8
- tech
- React, WordPress, Google Analytics
- script hosts
- x, cdn.cookielaw.org
- description
- Create with AI or code, deploy instantly on production infrastructure. One platform to build and ship.
RDAP / registration
rdap- domain
- netlify.com
- registrar
- Name.com, Inc.
- created
- 2014-06-09T19:55:48Z
- expires
- 2032-06-09T19:55:48Z
- nameservers
- dns1.p04.nsone.net, dns2.p04.nsone.net, dns3.p04.nsone.net, dns4.p04.nsone.net, ns01.netlifydns.com, ns02.netlifydns.com, ns03.netlifydns.com, ns04.netlifydns.com
- status
- client transfer prohibited
- error
- —
Public well-known
passive- /.well-known/security.txt
- HTTP 404
- /robots.txt
- HTTP 200 · found
- /security.txt
- HTTP 404