Proof First — External Security Review — onlinesecuritys.com

Prepared October 26, 2026 · Public, outside-view checks only

63 / 100 overall

Section	Score	Weight	Counts for
Email security	78 / 100	40%	31.2
Website & encryption	16 / 35	35 pts	16.0
Exposed services	not measured	25 pts	—
Overall			63 / 100

Overall is based on the email and website sections (75 points, scaled to 100) — the exposed-services check could not run from this network.

1 · Email security 78 / 100

Mail routing (MX records)ON TRACK

Email is routed through Microsoft 365.

Mail routing is the front door for business email; healthy routing keeps mail flowing to a real provider.

Sender policy (SPF)ON TRACK

SPF is published with a hard fail (-all) and uses 4 of the 10 allowed DNS lookups.

SPF tells receiving servers which senders may use your domain, so forged mail can be spotted.

Spoofing policy (DMARC)WORTH ATTENTION

DMARC policy is p=none — monitoring only. Forged email is watched, not stopped.

DMARC is the rule that tells the world what to do with email pretending to be you — the core defense against spoofing.

Message signing (DKIM)ON TRACK

DKIM signing keys found for selector(s): selector1, selector2.

DKIM signs outgoing mail so receivers can verify it really came from your systems.

Delivery encryption policy (MTA-STS)WORTH ATTENTION

Neither MTA-STS nor TLS-RPT records were found. These are bonus protections that guard delivery encryption.

MTA-STS and TLS-RPT protect the delivery path itself, keeping mail encrypted in transit.

Scoring	Points	Possible
Mail routing (MX records) — Strong	10	10
Sender policy (SPF) — Strong	25	25
Spoofing policy (DMARC) — Needs Attention	13.5	30
Message signing (DKIM) — Strong	25	25
Delivery encryption policy (MTA-STS) — Needs Attention	4.5	10
Email security subtotal	78	100

2 · Website & encryption 16 / 35

HTTPS is on and the certificate is validON TRACK

The site answers on https://onlinesecuritys.com (HTTP status 200) and presents a valid certificate issued by Let's Encrypt.

Encryption in transit keeps visitor traffic and form submissions private.

Plain HTTP redirects to HTTPSON TRACK

Visitors who type the plain http:// address are bounced to the encrypted version automatically.

This closes the unencrypted side door without relying on the visitor to notice.

Certificate is comfortably currentON TRACK

The certificate runs until January 22, 2027 — 87 days from this review.

An expired certificate triggers full-page browser warnings that drive visitors off.

Modern encryption standard (TLSv1.2)ON TRACK

The connection negotiates TLSv1.2.

Current TLS versions close the weaknesses found in the older standards attackers still probe for.

Missing header: Strict-Transport-Security (HSTS)WORTH ATTENTION

The site does not send the Strict-Transport-Security (HSTS) header.

HSTS tells browsers to only ever talk to the site over encrypted HTTPS.

Missing header: Content-Security-PolicyWORTH ATTENTION

The site does not send the Content-Security-Policy header.

A content security policy limits what scripts a page will run, blunting injected-code attacks.

Missing header: X-Content-Type-OptionsWORTH ATTENTION

The site does not send the X-Content-Type-Options header.

This header stops browsers from guessing file types, a trick used to smuggle malicious content.

Missing header: Referrer-PolicyWORTH ATTENTION

The site does not send the Referrer-Policy header.

Referrer-Policy controls how much page-address detail leaks to other sites when visitors click away.

No clickjacking protectionWORTH ATTENTION

Neither X-Frame-Options nor a CSP frame-ancestors rule is sent.

Other sites can embed your pages inside their own, a setup used to trick visitors into clicking attacker controls.

Software versions stay privateON TRACK

The site's headers do not announce product versions.

Attackers scanning the street learn less about what to aim at.

Scoring	Points	Possible
Site loads over HTTPS with a valid certificate	10	10
Certificate lifetime (87 days left)	3	3
Modern TLS version (TLSv1.2)	2	2
Header missing: Strict-Transport-Security (HSTS)	0	5
Header missing: Content-Security-Policy	0	5
Header missing: X-Content-Type-Options	0	3
Header missing: Referrer-Policy	0	2
Clickjacking protection (frame rules)	0	4
No software version disclosure	1	1
Website & encryption subtotal	16	35

3 · Exposed services not measured

This section was not measured this run (see the note inside).

Exposed-services check could not run from this networkWORTH ATTENTION

The network this review ran on intercepts outbound connections to service ports, so open/closed answers would not be trustworthy and none are reported. Run the Prospect Report tool from a normal internet connection to complete this section.

This section is left honestly blank rather than filled with numbers nobody verified.

Not scored this run: the review network intercepts outbound service connections, so no port results are reported rather than guessed.

4 · Domain basics

A	148.72.0.193
AAAA	lookup unavailable this run
MX	0 onlinesecuritys-com.mail.protection.outlook.com
NS	lookup unavailable this run

3 unique subdomains appear in public certificate-transparency records.

3 subdomains are visible in public certificate recordsON TRACK

Certificate-transparency logs show these public names: pay.onlinesecuritys.com, www.onlinesecuritys.com, www.pay.onlinesecuritys.com.

Every public subdomain is another door to keep patched and accounted for; forgotten test sites are a common way in.

What we would fix first

Move DMARC to enforcement (p=quarantine, then p=reject) so forged mail claiming to be from the domain is refused, with reporting turned on.
Add the missing protective website headers (HSTS, content security policy, and friends).
Add clickjacking protection (X-Frame-Options or CSP frame-ancestors) to the website.
Publish MTA-STS and TLS reporting records to protect mail delivery encryption.

Start with a free email checkup

We will walk through this review with you, confirm every finding, and price the fixes in plain numbers before any work begins. Call (833) 365-7047 or email info@smartsecuritys.com.