wsj.com

An authorized sender list is defined; mail from other servers is flagged as suspicious.

Forged email in the company's name is sent to the spam folder.

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

Mail exchangers are published for the domain.

The site loads over an encrypted connection.

Visitors arriving at an unencrypted address are automatically sent to the secure version.

The certificate was accepted by a validating TLS client at scan time.

Browsers aren't told to always use an encrypted connection, enabling interception attacks on public networks.

Missing Content-Security-Policy header: this removes one layer of protection against script injection.

Missing X-Frame-Options / frame-ancestors: this removes one layer of protection against clickjacking.

The browser may interpret files as code unintentionally.

Internal URLs (including parameters) may leak to external sites.

Access to sensitive features like the camera and location isn't restricted.

The server doesn't disclose software versions.

The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.

Any certificate authority can issue a certificate for the domain, raising the risk of mis-issuance.

The domain is served by several DNS servers, so one server failing won't take it down.