/ / d / vercel.com / web-standards / security
Security · vercel.com
pillar passed·Required·4 /4 items passing ·1 n/a
The minimum security baseline every site on the modern web should meet — valid TLS, baseline email auth, no exposed admin surfaces.
Items
| Item | Status | Backed by | Evidence |
|---|---|---|---|
| Valid TLS certificate | pass | factor 5 | ssl_days_remaining=53.18325177083333, not_after=2026-06-21T02:21:57.000Z, source=tls_handshake |
| No exposed sensitive paths | pass | factor 7 | dropped={"path":"/wp-admin","reason":"404_fallback_page"}|{"path":"/wp-login.php","reason":"404_fallback_page"}|{"path":"/xmlrpc.php","reason":"404_fallback_page"}|{"path":"/admin","reason":"404_fallback_page"}, total_checked=6, verifier_applied=true |
| DMARC published | pass | factor 1 | present=true, policy=quarantine |
| SPF record present | pass | factor 3 | present=true, raw="v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com include:mktomail.com include:amazonses.com include:sendgrid.net include:_spf.salesforce.com include:spf.mtasv.net ~all", qualifier=… |
| No WordPress user enumeration | na | factor 6 | n/a — not_wordpress |
Why each item matters
- Valid TLS certificate · methodology →
Every modern browser will block or warn on an invalid certificate. An expired or self-signed cert breaks the site for ordinary visitors.
- No exposed sensitive paths · methodology →
/.git, /.env, exposed /admin, or readable wp-config.php means credentials and source code are leaking. This is a vulnerability, not a polish issue.
- DMARC published · methodology →
Any DMARC policy (even p=none) shows the operator has thought about email spoofing. The bar cares about presence, not enforcement.
- SPF record present · methodology →
Without SPF, anyone can spoof mail from this domain. Required for any site whose domain is also used for email.
- No WordPress user enumeration · methodology →
When WordPress, the REST API leaking usernames hands attackers half of every credential pair. Strict pass — n/a on non-WP.