https://krone.at
Analyse abgeschlossen. 7 Schwachstellen gefunden · Score 57/100.
Unlock 4 masked findings
4 e-mails · clean PDF report · history
Sensitive reconnaissance findings
Recon · OSINT 🔒 maskedThis section contains sensitive findings (e-mails found, sensitive paths, server versions). For visitors without an account, actual values are masked — only count and status are shown. → Sign in for full view
of●●●@●●●.at
bb●●●@●●●.at
ku●●●@●●●.at
a.●●●@●●●.ru
🔒 4 e-mails readable by spam bots — sign up for free for the full list
Quick Wins — biggest impact
These 3 changes raise your score the most.
57 → 100
-
1
No cookie-consent tool i Cookie-Consent Required under GDPR and §165 TKG 2021: before setting non-essential cookies (analytics, marketing), users must actively and freely consent. Violations can be fined up to €20M or 4% of annual revenue.
+25 ⏱ 2–4 Stunden · aufwändigTracking scripts (analytics, marketing pixels) are loaded, but no consent-management tool was detected. Under GDPR and §165 TKG 2021 this is unlawful — fines up to €20M possible.
-
2
Content-Security-Policy missing i CSP Content-Security-Policy: defines which sources may load scripts, images and styles. The most effective defence against Cross-Site-Scripting (XSS) — attackers can no longer inject foreign code.
+10 ⏱ 30 Minuten · mittelNo CSP – high XSS risk.
-
3
HTTP is not redirected to HTTPS i HTTPS-Redirect Best practice: every request to http://… (port 80) is redirected via 301 to https://…. Prevents old bookmarks, embedded links or first visits from landing on plain HTTP — closing the door for man-in-the-middle attacks on first access (before HSTS can kick in).
+10 ⏱ 10 Minuten · leichtA request to
http://krone.atdoes return a redirect (301), but it does not lead to HTTPS – it points tohttp://www.krone.at/. Visitors with old bookmarks or embedded http links stay on the unencrypted connection.
+ 4 more vulnerabilities — see the list below
Scan categories
SSL & HTTPS
Passed ✓
HTTP headers
Issues ✗
DNS & infrastructure
Passed ✓
E-mail protection
Passed ✓
Open ports
Passed ✓
GDPR
Issues ✗
Vulnerabilities found
No cookie-consent tool
Tracking scripts (analytics, marketing pixels) are loaded, but no consent-management tool was detected. Under GDPR and §165 TKG 2021 this is unlawful — fines up to €20M possible.
+ 6 more vulnerabilities locked
Including action items & fixes — unlock for free
Save this report as PDF
With a free account: full PDF report with screenshot, Quick Wins, all recommendations and step-by-step fixes — perfect to show, archive or pass on to clients.
Terms in this report
Understand what we found — the key concepts behind the findings, briefly explained.
SSL & TLS
How SSL/TLS certificates work, how the handshake unfolds and what to watch for when checking — explained in plain English.
HSTS (Strict-Transport-Security) forces browsers permanently to HTTPS. Learn how the header is built, what includeSubDomains and p…
CAA records define which certificate authorities are allowed to issue SSL certificates for your domain. Protection against mis-iss…
DMARC protects your domain from e-mail spoofing. Learn how the record is structured, what p=none/quarantine/reject mean and how to…
SPF (Sender Policy Framework) prevents foreign servers from sending e-mails under your domain name. Structure, mechanisms and best…
DKIM signs your outgoing e-mails cryptographically — the recipient can reliably verify a mail came from you. Structure, selectors …
HTTP headers
The Content-Security-Policy is the most important browser-side defence against XSS. Learn how a CSP is structured and how to roll …
X-Frame-Options prevents clickjacking by controlling whether your site can be embedded in an iframe. Values DENY, SAMEORIGIN and t…
The Referrer-Policy controls which information is sent when users click external links. Values, privacy implications and safe defa…
The Permissions-Policy selectively disables browser features like geolocation, microphone, camera and FLoC. Structure, all directi…
X-Content-Type-Options: nosniff prevents browsers from guessing the MIME type of files. Protection against cross-site-scripting an…
Frontend & APIs
SRI protects external JavaScript and CSS files against tampering on the CDN. Hash-based integrity verification in the browser — ex…
Cross-Origin Resource Sharing controls which foreign sites may call your APIs. Same-Origin policy, preflight requests and the key …
Secure, HttpOnly and SameSite — the three most important cookie flags and what they do. How to harden sessions against XSS, MITM a…