Subject siteclearsite-demo-ledger.vercel.app
Report reference1100bed6-3f7d-4ea7-b1a6-5277349c9952
Scan dateJuly 26, 2026
Report versionFull
Scan moderead-only
Coveragecomplete
Pages scanned7
Engine versionv0.2.0
Industry profileLaw firm
Overall verdictPass
Scope of this report
This is a point-in-time automated technical scan of observable website behavior on the specific URLs scanned, as they existed at the scan date shown — not a legal compliance audit or attestation, and not an audit, certification, or compliance opinion of any kind. Results describe only the pages scanned at that time; they are not an assessment of the business or entity operating the site, and must not be represented as current after the scan date. A "pass" means no high-priority technical issues were found at the scan threshold on the pages crawled — it does not certify HIPAA, ADA, or any regulatory compliance, and does not cover items unobservable from outside (signed vendor agreements, server configuration, internal policies). Form analysis covers each form's declared submission target; forms that submit via JavaScript to endpoints not visible in the page markup are not assessed. Third-party/tracker detection matches a known-vendor catalog, so absence of a finding is not proof a site is free of trackers. This report is general information about observable technical facts and is not legal advice, does not create an attorney-client or other professional relationship, and is not a substitute for review by a qualified attorney. For your specific legal obligations, consult an attorney licensed in your jurisdiction. The exact URLs scanned are enumerated in the appendix at the end of this report.
What your site is costing you
Every observation from this scan, grouped by what it actually does to your business — the same five groups as your portal, ordered by severity. We describe how each one affects you; we never put a number on it, because that number would be a guess about your business rather than an observation about your site.
How exposed you are
4 observations
What does your site tell the outside world about how it is configured?
2 Medium2 Low
- No SPF record — anyone can send email as clearsite-demo-ledger.vercel.app
- No DMARC record — forged email from clearsite-demo-ledger.vercel.app is delivered unchecked
- No CAA record — any certificate authority can issue certs for clearsite-demo-ledger.vercel.app
and 1 more in this group
Details: the Security posture chapter in the findings below.
Checked, nothing found: the tools and tags you're running · people who can't use your site · being found · what you're promising. A real result about the pages we crawled — not a guarantee.
Risk overview
| Area | Highest | Findings | Severity mix |
|---|
| Website Security |
Medium |
4 |
2 Medium, 2 Low |
Findings
Findings are organised into the same six discipline chapters as your portal, then grouped by area and numbered area.item (3.2 = area 3, item 2). A sensitive tag marks a page whose URL, title, or form indicated health, identity, or payment context — the specific trigger is shown where recorded.
Security postureModerate risk
What your site tells the outside world about how it is configured — observed without touching it. 4 observations in this discipline.
1Email security3 findings
1.1No SPF record — anyone can send email as clearsite-demo-ledger.vercel.app
Medium
Website Security · Email security · observed · visitor exposure
Law firm clients and opposing parties are frequent targets of impersonation fraud. An attacker could send a message appearing to come from your domain — requesting a wire transfer, credentials, or sensitive documents — and receiving mail servers would have no technical signal to flag it as suspicious. Even if this domain is not your primary email domain, verify whether it is associated with any client-facing communications.
Observed: no v=spf1 TXT record on clearsite-demo-ledger.vercel.app
Status: First seen in this scan
Recommended fix: Add a DNS TXT record to clearsite-demo-ledger.vercel.app in the form "v=spf1 -all" if this domain never sends email, or "v=spf1 include:<your mail provider> -all" if it does. This change is made in your DNS host's control panel and typically takes effect within a few hours. If email for this domain is managed elsewhere, verify that the sending domain has its own SPF record configured correctly.
1.2No DMARC record — forged email from clearsite-demo-ledger.vercel.app is delivered unchecked
Medium
Website Security · Email security · observed · visitor exposure
Without a DMARC record, there is no published instruction telling other mail servers what to do if someone forges an email that appears to come from your domain. For a law firm, even the appearance that your domain is being used to send fraudulent email — such as fake billing instructions or client impersonation attempts — can damage client trust and raise questions about your handling of sensitive communications. Verify whether this domain is intended to send email now or in the future, as that affects urgency.
Observed: no v=DMARC1 TXT record at _dmarc.clearsite-demo-ledger.vercel.app
Status: First seen in this scan
Recommended fix: Publish a DMARC TXT record at _dmarc.clearsite-demo-ledger.vercel.app. Start with a policy of "p=none" and include a reporting address so you can monitor for any spoofing activity, then move to "p=quarantine" or "p=reject" once the reports show no legitimate mail is being affected.
1.3No CAA record — any certificate authority can issue certs for clearsite-demo-ledger.vercel.app
Low
Website Security · Email security · observed · missing safeguard
CAA is a cheap guard against certificate mis-issuance — if an attacker tricks some CA into issuing a cert for your domain, CAA can block it. One DNS record.
Observed: no CAA record for clearsite-demo-ledger.vercel.app
Status: First seen in this scan
Recommended fix: Add a CAA record naming your certificate authority (e.g. "0 issue \"letsencrypt.org\"").
2Transport security1 finding
2.1OCSP stapling is not enabled
Low
Website Security · Transport security · observed · missing safeguard
OCSP stapling speeds up the connection and improves privacy by proving the certificate isn't revoked without the browser contacting the CA. It's a server toggle.
Observed: no stapled OCSP response during the handshake
Status: First seen in this scan
Recommended fix: Enable OCSP stapling in the web server / load balancer configuration.
How deep we scanned
3,000+
known trackers screened
Beyond a cookie scan, we inspect every outbound channel — requests, form-field values, beacons, WebSockets, cookies and browser-storage writes — and match what we find against our live database of FDA, FTC, DOJ and state enforcement actions and court cases, updated continuously. The itemized breakdown of the 48 checks is in What we checked below.
Benchmarked against the standard tools
For each pillar, a detector for every defect class the recognized reference tools can find — verified check-by-check against the same rule catalog, on the same page.
| Pillar | Reference tool | Coverage | …and beyond |
|---|
| Accessibility a detector for every WCAG A/AA rule these engines run, proven on the same page |
axe-core |
65/65 |
each check mapped to its WCAG 2.2 success criterion (15 SCs, incl. Target Size — new in 2.2) |
| Google Lighthouse (Accessibility) |
57/57 |
the manual/unscored audits Lighthouse only links out for, we either check or skip with a documented reason |
| HTML CodeSniffer |
11/11 |
two error classes axe and Lighthouse leave to manual review — empty headings, fieldsets without a legend — we now detect |
| Security every HTTP-security and TLS check these graders run, plus the ones they don’t |
Mozilla Observatory |
9/9 |
21 checks Observatory does not run — TLS configuration, known-CVE libraries, SPF/DKIM/DMARC, DNSSEC/CAA |
| securityheaders.com |
6/6 |
we grade each header’s strength, not just its presence (weak CSP, short-max-age HSTS) |
| SSL Labs |
5/5 |
we grade the same TLS config offline (protocol, key exchange, cipher, certificate, HSTS) without a remote scan |
| retire.js + OSV.dev |
✓ |
we bundle both databases and detect their advisories by filename and by the runtime version a library exposes — recall a filename-only scan misses |
| Privacy every tracking behavior these inspectors report, proven against the same site |
Blacklight |
11/11 |
each tracker tied to the enforcement action it appeared in — context Blacklight does not carry |
| Disconnect |
5/5 |
we already bundle the list and detect by category — advertising, analytics, social, content, fingerprinting |
| WhoTracks.me |
5/5 |
we bundle it (5,089 domains) and use its owner data to name who each tracker belongs to |
| DuckDuckGo Tracker Radar |
11/11 |
its non-tracking categories (CDN, payment, SSO, badges) are correctly not flagged — precision, not blind spots |
| SEO a detector for every Lighthouse SEO audit and every Screaming Frog issue family |
Google Lighthouse (SEO) |
11/11 |
Google's open web-quality auditor |
| Screaming Frog SEO Spider |
16/16 |
the skipped tabs are deprecated or niche (meta keywords, rel-pagination, AMP), not gaps |
| Performance every Core Web Vital Google ranks on, from real-user field data |
Google CrUX (Core Web Vitals) |
3/3 |
plus lab load time, page weight, image weight and mobile readiness |
| Google Lighthouse (Performance) |
4/4 |
we run it via PageSpeed Insights and rate every lab metric; Total Blocking Time (its heaviest) now raises a finding |
| Claims & Trust the one pillar no scanner competes on — measured against the real enforcement record |
FTC / FDA / DOJ enforcement corpus |
✓ |
each finding matched to the enforcement action pattern it resembles |
Capability coverage means a detector exists for each defect class the reference tool can detect — verified check-by-check on the same page. It is not a claim of identical scoring, and for accessibility it is the machine-detectable subset of WCAG (~30–50% of the standard).
What we checked
The 105 checks of the standard we measure every site against, version 0.5, and what each did on this site across the 7 pages we read: 3 raised a finding, 75 checked and nothing found, 1 not measured on this scan, 26 not run on this scan.
● raised a finding ✓ checked and nothing found ◌ not measured on this scan ○ not run on this scan
Regulated-data privacy 20 checked and nothing found
✓ Advertising pixels on sensitive pages✓ Personal identifiers observed in transit✓ Session recording / heatmap tools✓ Customer-data-platform server-side fan-out✓ Device fingerprinting (by vendor and by technique)✓ Persistent identifiers in browser storage✓ Cross-network cookie syncing✓ CNAME-cloaked (first-party-disguised) trackers✓ Third-party WebSocket data streams✓ Third-party asset leakage on sensitive pages✓ Form submission destinations & encryption✓ Sensitive data in page addresses✓ Embedded chat / scheduling / form widgets✓ Tracking cookies vs consent timing✓ Consent enforcement (does Decline stop tags)✓ Global Privacy Control signal honored✓ Trackers that fire only on some devices✓ Site-platform vendor-agreement posture✓ Privacy policy present while collecting data✓ Separate consumer-health-data policy
Visitor privacy 14 checked and nothing found
✓ Third-party trackers & advertising pixels✓ Disguised trackers & hidden channels (CNAME cloaking, WebSocket streams)✓ Third parties we have no catalogued position on✓ Personal data observed leaving the browser✓ Session recording / heatmap tools✓ Device fingerprinting & persistent browser-storage identifiers✓ Cookie lifetime & third-party-set first-party cookies✓ Privacy policy present & consistent with observed behavior✓ Sale/share opt-out control actually present✓ Tracking cookies vs consent timing✓ Connections and pre-fetches made ahead of the visitor✓ High-value pages the site excluded from scanning✓ Tracking on the error/404 template✓ Where forms send what visitors type
Website security 3 raised a finding · 10 checked and nothing found
● TLS certificate, protocol version & cipher strength✓ HSTS / transport hardening✓ Content-Security-Policy✓ Security response headers✓ Cross-origin resource sharing (CORS)✓ Subresource integrity on third-party scripts✓ Secure / HttpOnly cookie flags✓ JavaScript libraries with published vulnerabilities✓ Scripts running site-wide that nothing identifies✓ Published security contact (security.txt)✓ Server software version disclosure● Email authentication (SPF / DKIM / DMARC)● DNS hardening (DNSSEC / CAA)
SEO & findability 14 checked and nothing found · 1 not measured on this scan
✓ Title & meta-description quality✓ Heading structure & H1✓ Canonical, robots & indexability✓ Sitemap presence & health✓ Structured data (schema.org)✓ Content depth, duplication & internal linking✓ Local business info (NAP)✓ Link health, anchor text & crawlability✓ URL structure & tracking parameters✓ International targeting (hreflang)✓ Page head & resource hygiene✓ AI crawler access (retrieval vs training)◌ AI retrieval: what robots.txt declares vs what a non-browser client received✓ Raw vs rendered HTML (JavaScript dependence)✓ Image markup (alt text, dimensions)
the non-browser probe did not run on this scan, so there is no receipt to compare against
Performance 7 checked and nothing found
✓ Core Web Vitals (field data)✓ Page & image weight✓ Render-blocking resources & font loading✓ Caching, protocol version & back/forward cache✓ Third-party request weight & DOM size✓ Mobile viewport & responsiveness✓ HTTPS redirect
Accessibility (ADA) 9 checked and nothing found
✓ Image & SVG alternative text✓ Form field labels & grouping✓ Color contrast & colour-only cues✓ Landmarks, headings & skip links✓ ARIA, accessible names & focus order✓ Zoom, target size & text spacing✓ Media captions & autoplay✓ Data table headers✓ Accessibility statement
Trust & substantiation 1 checked and nothing found
✓ Unsubstantiated marketing claims
Disclosures & representations 3 not run on this scan
○ FDIC / SIPC representation accuracy○ Affiliate / endorsement disclosure○ Investment guarantee language
not included in this scan
Pharmacy & Rx claims 4 not run on this scan
○ Drug-claim & fair-balance patterns○ Compounded / controlled-substance patterns○ Pharmacy legitimacy seals○ Telehealth disclosures (crisis line, emergency, consent)
not included in this scan
Subscription & billing 2 not run on this scan
○ Auto-renewal & negative-option disclosure○ Cancellation path clarity
not included in this scan
Fair housing & tenancy 6 not run on this scan
○ Listing copy screened for preference wording (§3604(c))○ Housing-assistance / voucher exclusions in advertising○ Pet policy vs assistance-animal accommodation○ Housing ad targeting exposure (Special Ad Category)○ Screening criteria & FCRA adverse-action disclosure○ Application / admin fee disclosure
not included in this scan
Consented egress test 1 not run on this scan
○ Field values observed leaving on a consented, never-submitted form
runs only with your written consent, on a site you have verified you own
Content & build integrity 4 not run on this scan
○ Unfilled placeholders and blank merge fields○ Page addresses: duplicates, broken links, and addresses that contradict the page○ Copy errors: doubled words and misspellings○ Pages that appear unfinished
not included in this scan
Services you pay for 6 not run on this scan
○ Conversion pages carrying none of the site's services○ Services present on some pages and not others○ Services that did not load on the pages that asked for them○ Vendors reporting to more than one account○ Two services doing one job, and site-wide tools left on one or two pages○ What each service adds to your pages
not included in this scan
A check that found nothing is a check that found nothing: it is not proof the issue is absent, and it is never a pass mark. A check that did not run says so, with the reason. A read-only scan of observable behavior: we identified our crawler honestly and honored robots directives. Detection matches a known-vendor catalog (vendor terms as of June 2026). Engine v0.2.0.
This is a point-in-time automated technical scan of observable website behavior on the specific URLs scanned, as they existed at the scan date shown — not a legal compliance audit or attestation, and not an audit, certification, or compliance opinion of any kind. Results describe only the pages scanned at that time; they are not an assessment of the business or entity operating the site, and must not be represented as current after the scan date. A "pass" means no high-priority technical issues were found at the scan threshold on the pages crawled — it does not certify HIPAA, ADA, or any regulatory compliance, and does not cover items unobservable from outside (signed vendor agreements, server configuration, internal policies). Form analysis covers each form's declared submission target; forms that submit via JavaScript to endpoints not visible in the page markup are not assessed. Third-party/tracker detection matches a known-vendor catalog, so absence of a finding is not proof a site is free of trackers. This report is general information about observable technical facts and is not legal advice, does not create an attorney-client or other professional relationship, and is not a substitute for review by a qualified attorney. For your specific legal obligations, consult an attorney licensed in your jurisdiction.
Full report · Assessment completeness: complete · Reference: 1100bed6-3f7d-4ea7-b1a6-5277349c9952 · Generated by ClearSite