Executive summary
paypal.com
Moderate exposure. There are gaps an attacker could exploit — fix them soon.
Full coverage: every applicable check was assessed.
2026-11-15 19:34 UTC
Useful for your IT provider or a colleague. Anyone with the link can view the report.
Track your progress
Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.
Spoofing email from this domain is hard.
Traffic to the site is encrypted and the certificate is valid.
Several browser hardening headers are missing, which removes layers of protection against script injection and framing.
The domain's infrastructure is well hardened.
Help someone else check their domain
Share this public report with a colleague. They can review the evidence and check their own domain.
What to do first
- 1.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://paypal.com/ | grep -i "Content-Security-Policy"
- 2.
Stop other sites from embedding your pages
This removes one way to trick visitors into clicking something on your site unknowingly.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://paypal.com/ | grep -i "X-Frame-Options"
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- paypal.com
- Website request
- GET https://paypal.com/ → https://www.paypal.com/gb/home
- Scan time
- 2026-11-15 19:34:36 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- None. Every applicable check was assessed.
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Get the badge
Show the live grade for paypal.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.
Scan shown on this page: 2026-11-15 19:34:36 UTC. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.
[](https://getmirror.online/report/paypal.com)<a href="https://getmirror.online/report/paypal.com"><img src="https://getmirror.online/badge/paypal.com.svg" alt="Domain Armor grade"></a>https://getmirror.online/badge/paypal.com.svgScan history
AI fix plan
Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.
Scans to analyze
0 of 6 selectedThe current scan is always included.
AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.
Agent access & discovery signals
Optional and unscored — it never changes the grade. Reads up to three public files from this site (robots.txt, llms.txt and /.well-known/security.txt) and reuses the homepage headers already fetched. llms.txt is an emerging proposal, not an official standard. It is informational and does not affect the grade.
Technical detail
Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.
Email security
29/30Encryption & certificate
25/25Browser protections
8/30DNS infrastructure
15/15Public DNS records
| A | paypal.com | 151.101.3.1 151.101.195.1 162.159.141.96 |
| AAAA | paypal.com | — |
| MX | paypal.com | 10 mx1.paypalcorp.com 10 mx2.paypalcorp.com |
| NS | paypal.com | pdns100.ultradns.com pdns100.ultradns.net ns1-pchnet.paypal.com ns2-pchnet.paypal.com |
| TXT | paypal.com | MS=ms95960309 mgf84gx1cv1c759pmjqx0wnths9ss9f6 docker-verification=2deb3c1f-56d2-4fe4-8a09-d48b7bf8a918 workplace-domain-verification=F7ezsH9uapvYDGd2VtPARy1qq9ymN6 globalsign-domain-verification=KXa3jn_dNODlTVQ4eg1Wx3vA-RrHZ2K7iLQN0vdJBx mgverify=e00c4bf7480ee22be851faa9acd20e41b8fd0f7b75b434bbe38aa257e5aae3a0 intersight=6d86ec09a7c6926c6f9b8eff8ef0ef06679d84aab4999756a0920a8d430ed8ae Notion_verify_uVqjH2PpjVthR9xxfR5BZGsuYGtqb6Za4uDHPaA917v5Cg5J0rRwiATz84PWHZh8Px7vFK stripe-verification=549bef27619f14f935a84c6a23492e80f49ff57a341d9ddc74d8486881cd0d8c adobe-idp-site-verification=11600efbec96c0e73dd8820cd33ca906ec4302aea4487d208a42a2b01806144c atlassian-domain-verification=Q8BdHlO6NYSN5njfC2rlbPQxksVfADlcxarxq4fesYJErtGKylvfcfyfwrPD/wnv v=spf1 include:pp._spf.paypal.com include:3ph1._spf.paypal.com include:3ph2._spf.paypal.com include:3ph3._spf.paypal.com include:3ph4._spf.paypal.com include:sendgrid.net include:aspmx.pardot.com ~all |
| TXT | _dmarc.paypal.com | v=DMARC1; p=reject; rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email; ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email |
| CAA | paypal.com | 0 issue "digicert.com" 0 issue "quovadisglobal.com" 0 issue "visa.com" |
| DS | paypal.com | 7037 13 2 9778f2ff96889ebed549795deaa40a6113f1899af7ca8dd7947fddfeca9a190b 31311 13 2 cc1996404e8cbe2e1b4aedcf8918d5fa215317f3d7ebf8d5c5581df98ab12dfd |