wysa.com security report

Certificate, security headers, email authentication, DNS, registration, and exposed hosts — from public sources.

15risk

Low

Minor observations only.

0Critical

0High

1Medium

2Low

1Info

Collected 17 hours ago8.0sfrom cache

noteCertificate inspection is unavailable in this runtime.
noteNetwork ownership lookup is unavailable in this runtime; ASN and org are omitted.
noteCDN/WAF detection is unavailable in this runtime.
note3 hosts were identified as CDN/edge infrastructure from ASN ownership rather than a cdncheck fingerprint.

Without HSTS the browser will still try http:// first on a fresh visit, which is the window an on-path attacker uses.
What to do
Send `Strict-Transport-Security: max-age=31536000; includeSubDomains` once you are sure everything works over HTTPS.
asset: https://www.wysa.com/
Lets browsers guess content types, which turns some upload and text endpoints into script injection points.
What to do
Send `X-Content-Type-Options: nosniff` on every response.
asset: https://www.wysa.com/
Full URLs — including any tokens or IDs in them — are sent to every third party the page links to.
What to do
Send `Referrer-Policy: strict-origin-when-cross-origin`.
asset: https://www.wysa.com/
Any public certificate authority may issue certificates for this domain. CAA lets you name the ones allowed to.
What to do
Add a CAA record naming your CA, e.g. `0 issue "letsencrypt.org"`.
asset: wysa.com

final https://www.wysa.com/status 200time 846msstack cloudflare

✓http:// redirects to https://
✗Strict-Transport-Security
✓Content-Security-Policy
default-src https: 'unsafe-inline' data:; frame-ancestors 'self' https://web.wysa.io https://staging-web.wysa.io https://dev-web.wysa.io https://dev.bot.touchki…
✓Clickjacking protection
via CSP frame-ancestors
✗X-Content-Type-Options
✗Referrer-Policy
–Permissions-Policyoptional
–security.txt publishedoptional — tells researchers where to report bugs

✓Receives mail via 5 servers
alt1.aspmx.l.google.com alt2.aspmx.l.google.com alt3.aspmx.l.google.com alt4.aspmx.l.google.com+1
✓SPFends in -all
v=spf1 include:_spf.google.com -all
✓DMARCp=quarantine
v=DMARC1; p=quarantine; rua=mailto:08fac4df7e6a4dde8e1bd1b7cf101e15@dmarc-reports.cloudflare.net,mailto:dmarc@wysa.io; ruf=mailto:dmarc@wysa.io; fo=1; pct=65; aspf=s; adkim=s;
✓MTA-STSinbound mail must use TLS

✓Registered with GoDaddy.com, LLC22.7 years old
wysa.com
✓Registration expiry831 days
2028-12-16
✓Transfer lock
client delete prohibited, client renew prohibited, client transfer prohibited, client update prohibited
✓2 nameservers at registry
ingrid.ns.cloudflare.com neil.ns.cloudflare.com

Address	Ports	Edge	Network
104.26.6.114 wysa.com +1	80443205220532082208320862087+5	Cloudflare~	—
104.26.7.114 wysa.com	80443205220532082208320862087+5	Cloudflare~	—
172.67.68.55 wysa.com +3	80443205220532082208320862087+5	Cloudflare~	—
99.86.18.55 mta-sts.wysa.com +2	80443	direct	—
99.86.18.76 mta-sts.wysa.com +2	80443	direct	—
99.86.18.50 mta-sts.wysa.com +1	80	direct	—
99.86.18.113 mta-sts.wysa.com +1	80	direct	—

Archived URLs

Endpoints the Wayback Machine has kept — config files, backups, scripts. Slow to fetch, so it is here on request.