{
  "domain": "example.com",
  "grade": "F",
  "score": 55,
  "scanned_at": "2026-11-05T20:52:22.685Z",
  "scoring_version": 2,
  "issues": [
    {
      "id": "dmarc",
      "title": "Tell receiving mail servers how to treat fake email from your domain",
      "severity": "low",
      "status": "warn"
    },
    {
      "id": "redirect",
      "title": "Send visitors to the secure version of your site",
      "severity": "high",
      "status": "fail"
    },
    {
      "id": "hsts",
      "title": "Tell browsers to always use the secure version",
      "severity": "high",
      "status": "fail"
    },
    {
      "id": "csp",
      "title": "Limit what scripts your pages are allowed to run",
      "severity": "medium",
      "status": "fail"
    },
    {
      "id": "clickjacking",
      "title": "Stop other sites from embedding your pages",
      "severity": "medium",
      "status": "fail"
    },
    {
      "id": "xcto",
      "title": "Stop browsers from guessing file types",
      "severity": "low",
      "status": "fail"
    },
    {
      "id": "referrer",
      "title": "Limit what your site shares when visitors click links",
      "severity": "low",
      "status": "fail"
    },
    {
      "id": "permissions",
      "title": "Turn off browser features your site does not use",
      "severity": "low",
      "status": "warn"
    },
    {
      "id": "caa",
      "title": "Choose which companies may issue certificates for your domain",
      "severity": "low",
      "status": "warn"
    }
  ],
  "what_to_do_first": [
    {
      "id": "hsts",
      "title": "Tell browsers to always use the secure version",
      "why": "Helps browsers use HTTPS on future visits after they have received the policy.",
      "who_can_fix": "Your web host",
      "verify": "curl -sIL https://example.com/ | grep -i \"Strict-Transport-Security\""
    },
    {
      "id": "csp",
      "title": "Limit what scripts your pages are allowed to run",
      "why": "This adds one layer of protection against injected scripts.",
      "who_can_fix": "Your website developer or web host",
      "verify": "curl -sIL https://example.com/ | grep -i \"Content-Security-Policy\""
    }
  ],
  "coverage": {
    "state": "partial",
    "assessed_weight": 95,
    "eligible_weight": 100,
    "ratio": 0.95
  },
  "excluded": [
    {
      "id": "dkim",
      "title": "DKIM — digital signature on email",
      "reason": "unverified"
    }
  ],
  "report_url": "https://getmirror.online/report/example.com",
  "methodology_url": "https://getmirror.online/methodology",
  "limitations": "Passive check of public configuration only (DNS, email authentication records, HTTPS and HTTP response headers of the homepage). It is not a penetration test, does not test the application, and a good grade is not a security guarantee."
}