What we check — your external security, in plain English
LuminaProtect runs a comprehensive set of passive checks across your internet-facing surface — email security, web headers, TLS/SSL, DNS, exposed services, vulnerable components, reputation, and supply chain. Here's what each one means and why it matters, written for a general IT audience.
Email security & anti-spoofing
Whether an attacker can send email that looks like it came from your domain — and whether your email is encrypted in transit. These are DNS records and mail-server settings anyone can read from the outside.
SPF (Sender Policy Framework)
What it is: A DNS record listing which mail servers are allowed to send email for your domain.
Why it matters: Missing or weak SPF lets attackers send email that appears to come from you, making phishing far easier.
DKIM (DomainKeys Identified Mail)
What it is: A cryptographic signature added to your outgoing email.
Why it matters: It lets receiving servers confirm a message really came from you and wasn't altered in transit.
DMARC
What it is: A policy that tells receivers what to do when SPF or DKIM fail (for example, reject the message).
Why it matters: Without an enforcing DMARC policy, anyone can spoof your domain and phish your staff, customers, or partners.
MTA-STS & MX TLS
What it is: Settings that require other mail servers to deliver to you over an encrypted (TLS) connection.
Why it matters: Without them, email to your domain can be downgraded to plaintext and read or tampered with in transit.
DANE / TLSA
What it is: Uses DNSSEC to pin the exact TLS certificate your mail server should present.
Why it matters: Stops an attacker from swapping in a fraudulent certificate to intercept your email.
BIMI
What it is: Lets your verified brand logo appear next to your emails in supporting inboxes.
Why it matters: Signals strong DMARC enforcement and builds recipient trust in your genuine mail.
Web security headers
Small instructions your website sends to the browser that switch on built-in protections. Missing headers are one of the most common — and easily fixed — web weaknesses.
Content-Security-Policy (CSP)
What it is: A rulebook telling the browser which scripts, styles, and images are allowed to load.
Why it matters: It's the strongest defense against cross-site scripting (XSS): if a malicious script is injected, the browser simply refuses to run it.
X-Frame-Options
What it is: Tells browsers whether your page may be embedded inside a frame on another website.
Why it matters: Without it, an attacker can invisibly overlay your site (clickjacking) and trick users into clicking things they didn't intend to.
HTTP Strict Transport Security (HSTS)
What it is: Forces browsers to always connect to your site over HTTPS.
Why it matters: Stops attackers from downgrading visitors to unencrypted HTTP and intercepting their data.
X-Content-Type-Options: nosniff
What it is: Stops the browser from guessing a file's type.
Why it matters: Prevents attackers from tricking the browser into running an image or text file as a script.
Referrer-Policy
What it is: Controls how much of your address bar is shared when a user clicks a link away from your site.
Why it matters: Prevents leaking sensitive URLs or tokens in the address to third-party sites.
Permissions-Policy
What it is: Declares which device features (camera, microphone, location) your site is allowed to use.
Why it matters: Blocks a hijacked or third-party script from silently accessing sensitive device features.
Cookie flags (Secure, HttpOnly, SameSite)
What it is: Settings that lock down how cookies can be accessed and sent.
Why it matters: Prevent session cookies from being stolen by scripts or sent over unencrypted connections.
TLS / SSL & certificates
The encryption that protects traffic to your site. We check that your certificates are valid and trusted and that the encryption itself is modern and strong.
Certificate expiry & validity
What it is: Whether your TLS certificate is expired, not yet valid, or revoked.
Why it matters: An expired or invalid certificate breaks the site and trains users to click through security warnings.
Trusted certificate chain
What it is: Whether your certificate is issued by a publicly trusted authority (not self-signed).
Why it matters: Untrusted certificates provide no real proof of identity and undermine user trust.
Deprecated TLS 1.0 / 1.1
What it is: Whether your server still accepts old, weak versions of TLS.
Why it matters: These versions have known weaknesses and are rejected by modern browsers — require TLS 1.2 or higher.
Weak ciphers & forward secrecy
What it is: Whether the server offers broken ciphers (RC4/3DES) or lacks forward secrecy.
Why it matters: Weak ciphers enable downgrade attacks; without forward secrecy, one stolen key can decrypt all past traffic.
DNS security & hygiene
The system that turns your domain name into a server address. Misconfigured DNS can let attackers redirect your traffic or hijack a forgotten subdomain.
DNSSEC
What it is: Cryptographically signs your DNS answers so they can't be forged.
Why it matters: Without it, attackers can spoof DNS responses and quietly redirect your visitors or email.
Dangling records & subdomain takeover
What it is: DNS records that still point to a cloud service you no longer own.
Why it matters: An attacker can claim that service and host content on your subdomain — phishing your users under your real domain.
DNS misconfiguration
What it is: Missing, duplicate, or overly permissive DNS records and name-server hygiene.
Why it matters: Sloppy DNS widens your attack surface and can break email or enable spoofing.
Attack surface & exposed services
Everything of yours that's reachable from the public internet. Every open door is something an attacker can probe — so we find the ones you may have forgotten.
Open ports & exposed services
What it is: Which network ports and services are reachable from the internet.
Why it matters: Every exposed service is a potential entry point; unnecessary ones needlessly widen your attack surface.
Exposed admin panels
What it is: Login pages and dashboards that are reachable from the public internet.
Why it matters: Internet-facing admin panels are prime targets for brute-force and exploit attempts.
Sensitive files & config exposure
What it is: Publicly reachable files such as backups, `.git`, or `.env` configuration.
Why it matters: Leaked files can hand attackers secrets, credentials, or source code.
Vulnerable components
Known security flaws in the software versions you actually run — prioritized so you fix what attackers are exploiting now, not a wall of noise.
CVE exposure
What it is: Known, publicly catalogued security flaws (CVEs) in software we detect on your surface.
Why it matters: Unpatched known flaws are one of the most common ways attackers break in.
Known-Exploited Vulnerabilities (KEV)
What it is: CVEs that attackers are actively exploiting in the wild right now.
Why it matters: These are the highest-priority fixes — real, current attacks, not theoretical risk.
EPSS prioritization
What it is: A score predicting how likely each vulnerability is to be exploited.
Why it matters: Helps you rank what to fix first instead of drowning in every possible CVE.
End-of-life (EOL) software
What it is: Software versions that no longer receive security patches.
Why it matters: EOL software accumulates unfixable flaws and should be upgraded or replaced.
Reputation & breach exposure
Signals from the wider internet about your domains and infrastructure — whether you're on blocklists or tied to known breaches.
Blocklist & abuse signals
What it is: Whether your domain or IPs appear on spam, malware, or abuse blocklists.
Why it matters: Listed domains get their email and traffic blocked, and it erodes customer trust.
Breach history
What it is: Credentials or data tied to your domain that appeared in known public breaches.
Why it matters: Exposed credentials are frequently reused by attackers to get in.
Supply chain (third-party scripts)
The third-party code running on the pages your users trust. A vulnerable script isn't just their problem — it runs in your users' browsers, on your domain.
Vulnerable JavaScript libraries
What it is: Outdated or known-vulnerable third-party scripts and libraries loading on your site.
Why it matters: Attackers exploit vulnerable client-side code to compromise your users directly from your pages.
SSH configuration
For any exposed SSH services, we check that the encryption settings are modern.
Weak SSH algorithms
What it is: Outdated SSH key-exchange, cipher, or MAC algorithms offered by the server.
Why it matters: Weak SSH settings can be downgraded or brute-forced, weakening a critical remote-access channel.
See these checks run against your own domain
Early-access design partners get a free outside-in posture review — every check above, scored and prioritized, with the evidence behind each finding.
Get my free posture review