Executive summary
hsbc.com
Moderate exposure. There are gaps an attacker could exploit — fix them soon.
Full coverage: every applicable check was assessed.
2026-11-15 19:34 UTC
Useful for your IT provider or a colleague. Anyone with the link can view the report.
Track your progress
Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.
Spoofing email from this domain is hard.
Encryption is in place, but a gap could expose users.
The site instructs browsers to block common attacks.
The domain's infrastructure lacks basic protections.
Help someone else check their domain
Share this public report with a colleague. They can review the evidence and check their own domain.
What to do first
- 1.
Send visitors to the secure version of your site
Visitors who type your address without https may stay on an unprotected connection.
Who can fix it: Your web host
How to verify after the fix
curl -sI http://hsbc.com/ | grep -iE "^(HTTP|location)"
- 2.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
dig +short DS hsbc.com
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- hsbc.com
- Website request
- GET https://hsbc.com/ → https://www.hsbc.com/
- Scan time
- 2026-11-15 19:34:34 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- None. Every applicable check was assessed.
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Get the badge
Show the live grade for hsbc.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.
Scan shown on this page: 2026-11-15 19:34:34 UTC. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.
[](https://getmirror.online/report/hsbc.com)<a href="https://getmirror.online/report/hsbc.com"><img src="https://getmirror.online/badge/hsbc.com.svg" alt="Domain Armor grade"></a>https://getmirror.online/badge/hsbc.com.svgScan history
AI fix plan
Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.
Scans to analyze
0 of 6 selectedThe current scan is always included.
AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.
Agent access & discovery signals
Optional and unscored — it never changes the grade. Reads up to three public files from this site (robots.txt, llms.txt and /.well-known/security.txt) and reuses the homepage headers already fetched. llms.txt is an emerging proposal, not an official standard. It is informational and does not affect the grade.
Technical detail
Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.
Email security
29/30Encryption & certificate
18/25Browser protections
25/30DNS infrastructure
3/15Public DNS records
| A | hsbc.com | 193.108.75.62 91.214.6.62 |
| AAAA | hsbc.com | — |
| MX | hsbc.com | 10 mxb-00299f02.gslb.pphosted.com 10 mxa-00299f02.gslb.pphosted.com |
| NS | hsbc.com | ns20.hsbc.uk ns3.hsbc.com ns6.hsbc.com ns21.hsbc.uk ns21.hsbc.net ns20.hsbc.net |
| TXT | hsbc.com | docker-verification=0a84016e-f30a-49a9-8a41-ef819b497664 docusign=e04d54f1-8d92-40bb-a780-2409999953c1 oMhmK373syyyImHpn7IVEXhqDzNC wiz-domain-verification=63f5e2e7316847f581f5c811d2057ac4c60fcff9e35a208a5cc63dda5808334f atlassian-domain-verification=MVrygCbxi4sy2tdpLKAsoHvnI7n6c7A07JAYd14laoh1RGylTMluWtKlGkVbBHoR JcqN2r7Z4NJrQpM4OGXTOw wiz-domain-verification=c4f9ca2f3b5e74b4502b2756d19f0936af847728b0927c6bf47b5271b5331bd1 wiz-domain-verification=0287380846b97f4f0f2a4ff03e53728406f0dce9a75011a27fed7b4df9f4027f jamf-site-verification=hUHjpDIEEf1eN5Q7FhUbZw work-accounts-domain-verification=p5eoAgBQd4EsOnDg2LKRdQ3g3rPYty v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com include:spf-00299f02.pphosted.com include:spf1.hsbc.com include:spf2.hsbc.com include:spf3.hsbc.com include:spf-002f0603.pphosted.com ~all google-site-verification=NI7zII4Ge_p28m0XfsDGMj77Nly4XabBi4MonUEVcUM google-site-verification=vPkZv7fjzUVwP2apQBxXmbtPQb0PAhU5k9KuxnAwr5o google-site-verification=M4iN_PX9kRTMMWq44Gj5N0yCKw21840zwBXdoBk1XJM adobe-idp-site-verification=97bd1b56bb7c1bf2b021fcc1aa99f303be57821beda2e03442612fe631a071e5 webexdomainverification.=de5860e7-75ed-4687-9345-095d6298d12b webexdomainverification.=e10dece0-359f-4aa8-85f9-8fd61121b3c1 webexdomainverification.JO59=608c80a0-fcc1-4022-8b7f-d99cee31b523 webexdomainverification.GVLY=f509eddc-026a-40ff-896d-94a2a7c5089a webexdomainverification.L2W7=69ac8949-902f-4c8c-90d0-4a0d3dcedb1c webexdomainverification.L2W2=72eed45f-93c2-4f58-8c1f-407b22083b6c webexdomainverification.=cf1ab7f9-8d4c-4d37-aff4-4a88b437614c 96b06eef013a4fa7ba21975d52f6cea8ba5586141e604aad968e8e8a6a6b0d0c adobe-sign-verification=33807990c7278c58bea18223c41dcf38 c77e0dfe9d1771b49cbbf615650b24e 8219-5848-B517-278B-A270-122C-5E8F-C5ED 6F33-A96D-4A70-B2F3-8980-0DA9-C687-9C2F 5700a0f161c3ee56b1cdb45f8ff0d606 f9fe8b945d159604d4fe56f68fd5a851 7c573538-4895-4bd2-90b9-13ecb67623b3 mongodb-site-verification=IZGVt2wuFTz4U2KdEQTxNjbTM5MQ4agI _github-challenge-hsbc-ent.hsbc.com=2c0124c517 docker-verification=2885f98d-883c-4171-88f5-44ebc35fd452 pendo-domain-verification=680c814a-0ddf-4099-8055-d7cc73af8d5a docusign=dd1edf13-79d6-4d57-ae88-ba915685297c |
| TXT | _dmarc.hsbc.com | v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com |
| CAA | hsbc.com | — |
| DS | hsbc.com | — |