certadel · external security posture certificate

Northwind Retail Group

3 assets assessed · 2026-03-14 09:41:00 UTC

Bronze mean score 84.1/100

The organisation tier is set by its weakest asset, blog.northwind.example — an attacker targets the softest host, so the grade follows the floor, not the average.

Verification code
CERTADEL-89DC-52AC-B22B
Authorized by
ciso@northwind.example
Engagement
ENG-2026-014
Tool
certadel 1.0.0

This is a self-assessment of publicly observable configuration (TLS, HTTP headers, DNS and email-authentication records). It is not an accredited audit and does not test application logic, authorisation or code. The verification code is derived from the posture itself: re-run certadel on the same assets and it will match until something material changes.

Assets

shop.northwind.example
Platinum 100/100
Transport security (TLS)100
HTTP security headers100
Cookie flags100
DNS & domain hygiene100
Email authentication100
Exposure & hygiene100
api.northwind.example
Gold 87.9/100
Transport security (TLS)100
HTTP security headers60.9
Cookie flags100
DNS & domain hygiene83.3
Email authentication84
Exposure & hygiene90
blog.northwind.example
Bronze 64.4/100
Transport security (TLS)100
HTTP security headers65.2
Cookie flags36.4
DNS & domain hygiene66.7
Email authentication20
Exposure & hygiene90

Findings

shop.northwind.example

pass Obsolete TLS versions are disabled

The host declined TLS 1.0 and 1.1; strongest negotiated was TLSv1.3.

{
  "legacyAccepted": [],
  "strongest": "TLSv1.3"
}

Reference

pass Certificate chain is trusted and current

Chain validated against system roots; issued by Let's Encrypt.

{
  "issuer": "Let's Encrypt"
}
pass Certificate is not near expiry

The certificate is valid for another 70 day(s).

{
  "daysRemaining": 70,
  "validTo": "2026-10-29T05:11:00.915Z"
}
pass Certificate key meets modern strength

EC key of 256 bits.

{
  "keyBits": 256,
  "keyType": "EC"
}
pass Negotiated cipher provides forward secrecy

Negotiated TLSv1.3 with TLS_AES_256_GCM_SHA384.

{
  "cipher": "TLS_AES_256_GCM_SHA384",
  "protocol": "TLSv1.3"
}
pass HSTS is enabled with a durable max-age

HSTS present with max-age 63072000, includeSubDomains, preload.

{
  "includeSubDomains": true,
  "maxAge": 63072000,
  "preload": true,
  "present": true
}

Reference

pass Content-Security-Policy is present

A Content-Security-Policy is present with no obvious script-source weakening.

{
  "directives": [
    "default-src",
    "object-src",
    "frame-ancestors",
    "base-uri"
  ]
}

Reference

pass X-Content-Type-Options is nosniff

nosniff is set.

{
  "value": "nosniff"
}

Reference

pass Clickjacking protection is present

Framing is restricted via CSP frame-ancestors.

{
  "cspFrameAncestors": true,
  "xFrameOptions": null
}

Reference

pass Referrer-Policy avoids leaking full URLs

Referrer-Policy is "strict-origin-when-cross-origin".

{
  "value": "strict-origin-when-cross-origin"
}

Reference

pass Permissions-Policy restricts powerful features

A Permissions-Policy header is present.

{
  "present": true
}

Reference

pass Server does not advertise software versions

No precise software versions are advertised in response headers.

{
  "server": null,
  "xPoweredBy": null
}

Reference

pass Cookies are marked Secure

All 1 cookie(s) satisfy this flag.

{
  "offending": [],
  "total": 1
}

Reference

pass Session cookies are marked HttpOnly

All 1 cookie(s) satisfy this flag.

{
  "offending": [],
  "total": 1
}

Reference

pass Cookies set an explicit SameSite policy

All 1 cookie(s) satisfy this flag.

{
  "offending": [],
  "total": 1
}

Reference

pass A CAA record restricts certificate issuance

CAA present, authorising: letsencrypt.org.

{
  "records": [
    {
      "critical": 0,
      "issue": "letsencrypt.org",
      "value": "letsencrypt.org"
    }
  ]
}

Reference

pass The domain has redundant nameservers

2 authoritative nameserver(s) are published.

{
  "nameservers": [
    "ns1.northwind.example",
    "ns2.northwind.example"
  ]
}
pass The zone is signed with DNSSEC

A validating resolver (cloudflare-dns.com) returned authenticated data for this zone.

{
  "authenticatedData": true,
  "resolver": "cloudflare-dns.com"
}

Reference

pass SPF authorises legitimate senders and rejects the rest

A single SPF record ends in -all (hard fail for unlisted senders).

{
  "lookups": 2,
  "qualifier": "-"
}

Reference

pass DMARC is published with an enforcing policy

DMARC p=reject with aggregate reporting.

{
  "pct": 100,
  "policy": "reject",
  "rua": "mailto:dmarc@northwind.example",
  "ruf": null,
  "subdomainPolicy": null,
  "version": "DMARC1"
}

Reference

pass A DKIM signing key is published

A DKIM key was found at selector(s): google.

{
  "selectors": [
    "google"
  ]
}
pass MTA-STS enforces TLS for inbound mail

MTA-STS is published in enforce mode.

{
  "mode": "enforce"
}

Reference

pass TLS-RPT requests transport-security reports

A TLS-RPT record is published.

{
  "present": true
}

Reference

pass Plain HTTP redirects to HTTPS

An HTTP request was redirected to https://shop.northwind.example/.

{
  "finalUrl": "https://shop.northwind.example/",
  "redirected": true
}

Reference

pass A security.txt tells researchers how to report issues

A security.txt is present with Contact and Expires fields.

{
  "hasContact": true,
  "hasExpires": true
}

Reference

pass The homepage loads no resources over plain HTTP

No plain-HTTP resource references were found in the homepage markup.

{
  "references": [],
  "truncatedBody": false
}

Reference

api.northwind.example

fail Clickjacking protection is present medium

Neither CSP frame-ancestors nor a restrictive X-Frame-Options is set.

What to do Set CSP frame-ancestors 'self' (preferred) or X-Frame-Options: SAMEORIGIN.

{
  "cspFrameAncestors": false,
  "xFrameOptions": null
}

Reference

warn Content-Security-Policy is present

CSP present but weakened: script-src allows 'unsafe-inline'.

What to do Remove 'unsafe-inline' and 'unsafe-eval' from script-src and avoid wildcard sources; adopt nonces or hashes for inline scripts.

{
  "weaknesses": [
    "script-src allows 'unsafe-inline'"
  ]
}

Reference

warn DMARC is published with an enforcing policy

DMARC p=quarantine; forged mail is quarantined but not rejected outright.

What to do Advance to p=reject once quarantine has shown no false positives.

{
  "pct": 100,
  "policy": "quarantine",
  "rua": "mailto:dmarc@northwind.example",
  "ruf": null,
  "subdomainPolicy": null,
  "version": "DMARC1"
}

Reference

warn Permissions-Policy restricts powerful features

No Permissions-Policy header is set.

What to do Add a Permissions-Policy that disables features the site does not use (camera, microphone, geolocation, etc.).

{
  "present": false
}

Reference

warn Server does not advertise software versions

Version information is disclosed: nginx/1.24.0.

What to do Suppress version detail in the Server header and remove X-Powered-By. It hands an attacker a shortlist of version-specific exploits for free.

{
  "server": "nginx/1.24.0",
  "xPoweredBy": null
}

Reference

warn The zone is signed with DNSSEC

The zone is not DNSSEC-validated according to cloudflare-dns.com.

What to do Enable DNSSEC signing at your DNS provider and publish the DS record at the registrar, so responses cannot be forged in transit.

{
  "authenticatedData": false,
  "resolver": "cloudflare-dns.com"
}

Reference

warn A security.txt tells researchers how to report issues

No security.txt was served at /.well-known/security.txt.

What to do Publish /.well-known/security.txt with at least a Contact and an Expires field (RFC 9116), so anyone who finds a flaw knows how to reach you.

{
  "present": false
}

Reference

pass Obsolete TLS versions are disabled

The host declined TLS 1.0 and 1.1; strongest negotiated was TLSv1.3.

{
  "legacyAccepted": [],
  "strongest": "TLSv1.3"
}

Reference

pass Certificate chain is trusted and current

Chain validated against system roots; issued by Let's Encrypt.

{
  "issuer": "Let's Encrypt"
}
pass Certificate is not near expiry

The certificate is valid for another 70 day(s).

{
  "daysRemaining": 70,
  "validTo": "2026-10-29T05:11:00.918Z"
}
pass Certificate key meets modern strength

EC key of 256 bits.

{
  "keyBits": 256,
  "keyType": "EC"
}
pass Negotiated cipher provides forward secrecy

Negotiated TLSv1.3 with TLS_AES_256_GCM_SHA384.

{
  "cipher": "TLS_AES_256_GCM_SHA384",
  "protocol": "TLSv1.3"
}
pass HSTS is enabled with a durable max-age

HSTS present with max-age 63072000, includeSubDomains, preload.

{
  "includeSubDomains": true,
  "maxAge": 63072000,
  "preload": true,
  "present": true
}

Reference

pass X-Content-Type-Options is nosniff

nosniff is set.

{
  "value": "nosniff"
}

Reference

pass Referrer-Policy avoids leaking full URLs

Referrer-Policy is "strict-origin-when-cross-origin".

{
  "value": "strict-origin-when-cross-origin"
}

Reference

pass Cookies are marked Secure

All 1 cookie(s) satisfy this flag.

{
  "offending": [],
  "total": 1
}

Reference

pass Session cookies are marked HttpOnly

All 1 cookie(s) satisfy this flag.

{
  "offending": [],
  "total": 1
}

Reference

pass Cookies set an explicit SameSite policy

All 1 cookie(s) satisfy this flag.

{
  "offending": [],
  "total": 1
}

Reference

pass A CAA record restricts certificate issuance

CAA present, authorising: letsencrypt.org.

{
  "records": [
    {
      "critical": 0,
      "issue": "letsencrypt.org",
      "value": "letsencrypt.org"
    }
  ]
}

Reference

pass The domain has redundant nameservers

2 authoritative nameserver(s) are published.

{
  "nameservers": [
    "ns1.northwind.example",
    "ns2.northwind.example"
  ]
}
pass SPF authorises legitimate senders and rejects the rest

A single SPF record ends in -all (hard fail for unlisted senders).

{
  "lookups": 2,
  "qualifier": "-"
}

Reference

pass A DKIM signing key is published

A DKIM key was found at selector(s): google.

{
  "selectors": [
    "google"
  ]
}
pass MTA-STS enforces TLS for inbound mail

MTA-STS is published in enforce mode.

{
  "mode": "enforce"
}

Reference

pass TLS-RPT requests transport-security reports

A TLS-RPT record is published.

{
  "present": true
}

Reference

pass Plain HTTP redirects to HTTPS

An HTTP request was redirected to https://api.northwind.example/.

{
  "finalUrl": "https://api.northwind.example/",
  "redirected": true
}

Reference

pass The homepage loads no resources over plain HTTP

No plain-HTTP resource references were found in the homepage markup.

{
  "references": [],
  "truncatedBody": false
}

Reference

blog.northwind.example

fail Content-Security-Policy is present high

No Content-Security-Policy header was returned.

What to do Add a Content-Security-Policy. Even a conservative policy that sets default-src 'self' and object-src 'none' materially reduces XSS impact.

{
  "present": false
}

Reference

fail SPF authorises legitimate senders and rejects the rest high

No SPF record was found.

What to do Publish an SPF record listing your authorised senders and ending in -all, so receivers can reject mail from anywhere else.

{
  "count": 0
}

Reference

fail DMARC is published with an enforcing policy high

No DMARC record was found at _dmarc.

What to do Publish a DMARC record. Start at p=none with a rua address to observe, then move to p=quarantine and p=reject as confidence grows.

{
  "present": false
}

Reference

fail Session cookies are marked HttpOnly medium

1 of 1 cookie(s) miss it: tracker.

What to do Add HttpOnly to cookies that scripts do not need to read, so an XSS flaw cannot steal them.

{
  "offending": [
    "tracker"
  ],
  "total": 1
}

Reference

fail Cookies set an explicit SameSite policy medium

1 of 1 cookie(s) miss it: tracker.

What to do Set SameSite=Lax or Strict to blunt cross-site request forgery.

{
  "offending": [
    "tracker"
  ],
  "total": 1
}

Reference

warn Permissions-Policy restricts powerful features

No Permissions-Policy header is set.

What to do Add a Permissions-Policy that disables features the site does not use (camera, microphone, geolocation, etc.).

{
  "present": false
}

Reference

warn A CAA record restricts certificate issuance

No CAA record was found, so any CA may issue certificates for this domain.

What to do Publish a CAA record naming only the CAs you use, so no other CA can mis-issue a certificate for your domain.

{
  "records": []
}

Reference

warn The zone is signed with DNSSEC

The zone is not DNSSEC-validated according to cloudflare-dns.com.

What to do Enable DNSSEC signing at your DNS provider and publish the DS record at the registrar, so responses cannot be forged in transit.

{
  "authenticatedData": false,
  "resolver": "cloudflare-dns.com"
}

Reference

warn A DKIM signing key is published

No DKIM key was found at the common selectors probed (google). It may use a custom selector.

What to do Confirm DKIM is enabled at your mail provider. DKIM is what lets DMARC survive legitimate forwarding.

{
  "probed": [
    "google"
  ]
}

Reference

warn MTA-STS enforces TLS for inbound mail

No MTA-STS policy is published.

What to do Publish an MTA-STS policy in enforce mode so sending servers require TLS and a valid certificate when delivering to you.

{
  "present": false
}

Reference

warn TLS-RPT requests transport-security reports

No TLS-RPT record is published.

What to do Publish a TLS-RPT record so you receive reports when senders fail to negotiate TLS.

{
  "present": false
}

Reference

warn A security.txt tells researchers how to report issues

No security.txt was served at /.well-known/security.txt.

What to do Publish /.well-known/security.txt with at least a Contact and an Expires field (RFC 9116), so anyone who finds a flaw knows how to reach you.

{
  "present": false
}

Reference

pass Obsolete TLS versions are disabled

The host declined TLS 1.0 and 1.1; strongest negotiated was TLSv1.2.

{
  "legacyAccepted": [],
  "strongest": "TLSv1.2"
}

Reference

pass Certificate chain is trusted and current

Chain validated against system roots; issued by Let's Encrypt.

{
  "issuer": "Let's Encrypt"
}
pass Certificate is not near expiry

The certificate is valid for another 70 day(s).

{
  "daysRemaining": 70,
  "validTo": "2026-10-29T05:11:00.918Z"
}
pass Certificate key meets modern strength

RSA key of 2048 bits.

{
  "keyBits": 2048,
  "keyType": "RSA"
}
pass Negotiated cipher provides forward secrecy

Negotiated TLSv1.2 with ECDHE-RSA-AES128-GCM-SHA256.

{
  "cipher": "ECDHE-RSA-AES128-GCM-SHA256",
  "protocol": "TLSv1.2"
}
pass HSTS is enabled with a durable max-age

HSTS present with max-age 15552000.

{
  "includeSubDomains": false,
  "maxAge": 15552000,
  "preload": false,
  "present": true
}

Reference

pass X-Content-Type-Options is nosniff

nosniff is set.

{
  "value": "nosniff"
}

Reference

pass Clickjacking protection is present

Framing is restricted via X-Frame-Options.

{
  "xFrameOptions": "sameorigin"
}

Reference

pass Referrer-Policy avoids leaking full URLs

Referrer-Policy is "strict-origin-when-cross-origin".

{
  "value": "strict-origin-when-cross-origin"
}

Reference

pass Server does not advertise software versions

No precise software versions are advertised in response headers.

{
  "server": null,
  "xPoweredBy": null
}

Reference

pass Cookies are marked Secure

All 1 cookie(s) satisfy this flag.

{
  "offending": [],
  "total": 1
}

Reference

pass The domain has redundant nameservers

2 authoritative nameserver(s) are published.

{
  "nameservers": [
    "ns1.northwind.example",
    "ns2.northwind.example"
  ]
}
pass Plain HTTP redirects to HTTPS

An HTTP request was redirected to https://blog.northwind.example/.

{
  "finalUrl": "https://blog.northwind.example/",
  "redirected": true
}

Reference

pass The homepage loads no resources over plain HTTP

No plain-HTTP resource references were found in the homepage markup.

{
  "references": [],
  "truncatedBody": false
}

Reference