EdgeIQ Labs · Monthly Report
82/100
Posture: Good · 2 critical fixes recommended this month
Overall security posture improved 4 points since March. Two critical items remain: an expiring SSL certificate and a recently exposed admin login page on a forgotten subdomain.
▲ +4 vs last monthSSL & Domain Expiry
SSL certificate expires in 12 daysacmecoffee.example · Let's Encrypt · expires 2026-05-12
Critical
Domain registration valid for 18 monthsacmecoffee.example · expires 2027-11-04
OK
Security Headers
Missing Content-Security-Policy headerReduces XSS protection. Recommended: start with report-only mode.
Medium
HSTS, X-Frame-Options, X-Content-Type-Options all present3 of 5 critical headers configured correctly
OK
Attack Surface (Subdomains)
Exposed admin login: old-staging.acmecoffee.exampleUnprotected /admin login form. No MFA, no rate-limiting, default WordPress paths visible.
Critical
3 new subdomains discovered this monthcdn.acmecoffee.example, beta.acmecoffee.example, mail-test.acmecoffee.example
Review
Email Authentication (SPF / DKIM / DMARC)
SPF + DKIM correctly configuredBoth records valid. Strong protection against spoofed sender domains.
OK
DMARC policy is p=noneReceiving policy is monitor-only. Recommend graduating to p=quarantine after 30 days.
Medium
Uptime & Availability
99.97% uptime this month2 brief outages totaling 11 minutes. Both auto-recovered. Average response time: 312 ms.
OK
Top 3 Actions This Month
Recommended in priority order
- Renew SSL certificate before May 12.Auto-renew via Let's Encrypt + certbot. EdgeIQ Fix-it can automate this — toggle in your dashboard.
- Take old-staging.acmecoffee.example offline or add MFA.If staging is no longer used, delete the DNS record. If still needed, gate behind Cloudflare Access or VPN.
- Graduate DMARC from p=none to p=quarantine.Monitor reports for 30 days first to identify legitimate senders, then increase enforcement.
What Changed Since March
↑ Improved
- HSTS header added
- Outdated CMS plugin patched
- Score: 78 → 82
↓ Regressed / new
- SSL cert nearing expiry
- 3 new subdomains exposed
- Admin login surfaced on staging