ClearSite
Website risk & compliance intelligence
REPORT REF
1100bed6-3f7d-4ea7-b1a6-5277349c9952
Website Risk & Exposure Report
clearsite-demo-ledger.vercel.app
Verdict: Pass
Report dateJuly 26, 2026 Pages reviewed7 Industry profileLaw firm Scan moderead-only
Prepared by ClearSite Point-in-time assessment · for the site owner’s use

Document control

Subject siteclearsite-demo-ledger.vercel.app
Report reference1100bed6-3f7d-4ea7-b1a6-5277349c9952
Scan dateJuly 26, 2026
Report versionFull
Scan moderead-only
Coveragecomplete
Pages scanned7
Engine versionv0.2.0
Industry profileLaw firm
Overall verdictPass

Scope of this report

This is a point-in-time automated technical scan of observable website behavior on the specific URLs scanned, as they existed at the scan date shown — not a legal compliance audit or attestation, and not an audit, certification, or compliance opinion of any kind. Results describe only the pages scanned at that time; they are not an assessment of the business or entity operating the site, and must not be represented as current after the scan date. A "pass" means no high-priority technical issues were found at the scan threshold on the pages crawled — it does not certify HIPAA, ADA, or any regulatory compliance, and does not cover items unobservable from outside (signed vendor agreements, server configuration, internal policies). Form analysis covers each form's declared submission target; forms that submit via JavaScript to endpoints not visible in the page markup are not assessed. Third-party/tracker detection matches a known-vendor catalog, so absence of a finding is not proof a site is free of trackers. This report is general information about observable technical facts and is not legal advice, does not create an attorney-client or other professional relationship, and is not a substitute for review by a qualified attorney. For your specific legal obligations, consult an attorney licensed in your jurisdiction. The exact URLs scanned are enumerated in the appendix at the end of this report.

1

Executive Summary

LOW CRITICAL Moderate OVERALL RISK a verdict, not a score
PASSNo high-priority technical issues found in this scan

This assessment identified 4 issues, none critical, that improve the site's standing once resolved. The most significant exposure is concentrated in website security.

Why this verdict: The verdict is Moderate, driven by 2 medium-severity findings.

0
Critical
0
High
2
Medium
2
Low
4
Total
SEO
100/100
Performance · measured
100/100
UX
100/100
Technical scores: 100 less a fixed deduction per issue found — they rank your own scans against each other, not your site against anyone else's. Performance is the exception: measured by Google Lighthouse plus real-world Core Web Vitals. Compliance, privacy and security risk are reported as a verdict, never a number.
Core Web Vitals · measured · mobile
Lab LCP 1.2 s · CLS 0 · TBT 0 ms · FCP 0.9 s
How to read this report

Severity ranks how much attention an item warrants: Critical rests on an observed fact on a sensitive page; High is a strong exposure; Medium/Low are lower-priority. Observed vs. verify: we report what we saw leave the browser as fact; anything we cannot see from outside (a signed agreement, a server config) we mark to verify, never assert. "Sensitive context" means a page whose URL, title, or form indicates health, identity, or payment data.

What to do, in order

3 changes, in the order we would make them — 2 of the 4 items are covered by just 1 of them, because one change can settle several at once.

  1. 1 Set up SPF & DMARC email authenticationclears 2 itemsMedium Website Security · Email security
    Publish SPF and DMARC DNS records so forged email from your domain gets rejected and real mail lands in inboxes.
  2. 2 DNS hardeningLow Website Security · Email security
    Enable DKIM signing, DNSSEC, and a CAA record — registrar/DNS configuration.
    We can supply the exact change to apply.
  3. 3 TLS hardeningLow Website Security · Transport security
    Server/load-balancer config: disable TLS 1.0/1.1, prefer ECDHE ciphers, enable TLS 1.3 and OCSP stapling.
    We can supply the exact change to apply.

Ordered by severity, then by how many items one change settles. Cost are deliberately NOT part of that order — cheapest-first would sell you the easy work rather than the work that matters.

2

The evidence

What your site is costing you

Every observation from this scan, grouped by what it actually does to your business — the same five groups as your portal, ordered by severity. We describe how each one affects you; we never put a number on it, because that number would be a guess about your business rather than an observation about your site.

How exposed you are

4 observations

What does your site tell the outside world about how it is configured?

2 Medium2 Low
  • No SPF record — anyone can send email as clearsite-demo-ledger.vercel.app
  • No DMARC record — forged email from clearsite-demo-ledger.vercel.app is delivered unchecked
  • No CAA record — any certificate authority can issue certs for clearsite-demo-ledger.vercel.app

and 1 more in this group

Details: the Security posture chapter in the findings below.

Checked, nothing found: the tools and tags you're running · people who can't use your site · being found · what you're promising. A real result about the pages we crawled — not a guarantee.

Risk overview

AreaHighestFindingsSeverity mix
Website Security Medium 4
2 Medium, 2 Low

Findings

Findings are organised into the same six discipline chapters as your portal, then grouped by area and numbered area.item (3.2 = area 3, item 2). A sensitive tag marks a page whose URL, title, or form indicated health, identity, or payment context — the specific trigger is shown where recorded.

Security postureModerate risk

What your site tells the outside world about how it is configured — observed without touching it. 4 observations in this discipline.

1Email security3 findings

1.1
No SPF record — anyone can send email as clearsite-demo-ledger.vercel.app
Medium
Website Security · Email security · 85%

Law firm clients and opposing parties are frequent targets of impersonation fraud. An attacker could send a message appearing to come from your domain — requesting a wire transfer, credentials, or sensitive documents — and receiving mail servers would have no technical signal to flag it as suspicious. Even if this domain is not your primary email domain, verify whether it is associated with any client-facing communications.

Observed: no v=spf1 TXT record on clearsite-demo-ledger.vercel.app

Recommended fix: Add a DNS TXT record to clearsite-demo-ledger.vercel.app in the form "v=spf1 -all" if this domain never sends email, or "v=spf1 include:<your mail provider> -all" if it does. This change is made in your DNS host's control panel and typically takes effect within a few hours. If email for this domain is managed elsewhere, verify that the sending domain has its own SPF record configured correctly.

1.2
No DMARC record — forged email from clearsite-demo-ledger.vercel.app is delivered unchecked
Medium
Website Security · Email security · 85%

Without a DMARC record, there is no published instruction telling other mail servers what to do if someone forges an email that appears to come from your domain. For a law firm, even the appearance that your domain is being used to send fraudulent email — such as fake billing instructions or client impersonation attempts — can damage client trust and raise questions about your handling of sensitive communications. Verify whether this domain is intended to send email now or in the future, as that affects urgency.

Observed: no v=DMARC1 TXT record at _dmarc.clearsite-demo-ledger.vercel.app

Recommended fix: Publish a DMARC TXT record at _dmarc.clearsite-demo-ledger.vercel.app. Start with a policy of "p=none" and include a reporting address so you can monitor for any spoofing activity, then move to "p=quarantine" or "p=reject" once the reports show no legitimate mail is being affected.

1.3
No CAA record — any certificate authority can issue certs for clearsite-demo-ledger.vercel.app
Low
Website Security · Email security · 72%

CAA is a cheap guard against certificate mis-issuance — if an attacker tricks some CA into issuing a cert for your domain, CAA can block it. One DNS record.

Observed: no CAA record for clearsite-demo-ledger.vercel.app

Recommended fix: Add a CAA record naming your certificate authority (e.g. "0 issue \"letsencrypt.org\"").

2Transport security1 finding

2.1
OCSP stapling is not enabled
Low
Website Security · Transport security · 70%

OCSP stapling speeds up the connection and improves privacy by proving the certificate isn't revoked without the browser contacting the CA. It's a server toggle.

Observed: no stapled OCSP response during the handshake

Recommended fix: Enable OCSP stapling in the web server / load balancer configuration.

4

Methodology & depth

How deep we scanned

48
checks run
3,000+
known trackers screened
6
analysis lenses
Full
page capture

Beyond a cookie scan, we inspect every outbound channel — requests, form-field values, beacons, WebSockets, cookies and browser-storage writes — and match what we find against our live database of FDA, FTC, DOJ and state enforcement actions and court cases, updated continuously. The itemized breakdown of the 48 checks is in What we checked below.

Benchmarked against the standard tools

For each pillar, a detector for every defect class the recognized reference tools can find — verified check-by-check against the same rule catalog, on the same page.

PillarReference toolCoverage…and beyond
Accessibility
a detector for every WCAG A/AA rule these engines run, proven on the same page
axe-core 65/65 each check mapped to its WCAG 2.2 success criterion (15 SCs, incl. Target Size — new in 2.2)
Google Lighthouse (Accessibility) 57/57 the manual/unscored audits Lighthouse only links out for, we either check or skip with a documented reason
HTML CodeSniffer 11/11 two error classes axe and Lighthouse leave to manual review — empty headings, fieldsets without a legend — we now detect
Security
every HTTP-security and TLS check these graders run, plus the ones they don’t
Mozilla Observatory 9/9 21 checks Observatory does not run — TLS configuration, known-CVE libraries, SPF/DKIM/DMARC, DNSSEC/CAA
securityheaders.com 6/6 we grade each header’s strength, not just its presence (weak CSP, short-max-age HSTS)
SSL Labs 5/5 we grade the same TLS config offline (protocol, key exchange, cipher, certificate, HSTS) without a remote scan
retire.js + OSV.dev we bundle both databases and detect their advisories by filename and by the runtime version a library exposes — recall a filename-only scan misses
Privacy
every tracking behavior these inspectors report, proven against the same site
Blacklight 11/11 each tracker tied to the enforcement action it appeared in — context Blacklight does not carry
Disconnect 5/5 we already bundle the list and detect by category — advertising, analytics, social, content, fingerprinting
WhoTracks.me 5/5 we bundle it (5,089 domains) and use its owner data to name who each tracker belongs to
DuckDuckGo Tracker Radar 11/11 its non-tracking categories (CDN, payment, SSO, badges) are correctly not flagged — precision, not blind spots
SEO
a detector for every Lighthouse SEO audit and every Screaming Frog issue family
Google Lighthouse (SEO) 11/11 Google's open web-quality auditor
Screaming Frog SEO Spider 16/16 the skipped tabs are deprecated or niche (meta keywords, rel-pagination, AMP), not gaps
Performance
every Core Web Vital Google ranks on, from real-user field data
Google CrUX (Core Web Vitals) 3/3 plus lab load time, page weight, image weight and mobile readiness
Google Lighthouse (Performance) 4/4 we run it via PageSpeed Insights and rate every lab metric; Total Blocking Time (its heaviest) now raises a finding
Claims & Trust
the one pillar no scanner competes on — measured against the real enforcement record
FTC / FDA / DOJ enforcement corpus each finding matched to the enforcement action pattern it resembles

Capability coverage means a detector exists for each defect class the reference tool can detect — verified check-by-check on the same page. It is not a claim of identical scoring, and for accessibility it is the machine-detectable subset of WCAG (~30–50% of the standard).

What we checked

48 checks ran across 7 pages; 46 found no issue, 2 raised a finding:

Regulated-data privacy 18 checked clean
✓ Advertising pixels on sensitive pages✓ Personal identifiers observed in transit✓ Session recording / heatmap tools✓ Customer-data-platform server-side fan-out✓ Device fingerprinting (by vendor and by technique)✓ Persistent identifiers in browser storage✓ Cross-network cookie syncing✓ CNAME-cloaked (first-party-disguised) trackers✓ Third-party WebSocket data streams✓ Third-party asset leakage on sensitive pages✓ Form submission destinations & encryption✓ Sensitive data in page addresses✓ Embedded chat / scheduling / form widgets✓ Tracking cookies vs consent timing✓ Consent enforcement (does Decline stop tags)✓ Site-platform vendor-agreement posture✓ Privacy policy present while collecting data✓ Separate consumer-health-data policy
Website security 2 flagged · 7 checked clean
✓ TLS certificate validity & version✓ HSTS / transport hardening✓ Content-Security-Policy✓ Security response headers✓ Subresource integrity on third-party scripts✓ Secure / HttpOnly cookie flags✓ Server software version disclosure● Email authentication (SPF / DKIM / DMARC)● DNS hardening (DNSSEC / CAA)
SEO & findability 8 checked clean
✓ Title & meta-description quality✓ Heading structure & H1✓ Canonical, robots & indexability✓ Sitemap presence✓ Structured data (schema.org)✓ Content depth & internal linking✓ Local business info (NAP)✓ Broken internal links
Performance 4 checked clean
✓ Core Web Vitals (field data)✓ Page & image weight✓ Mobile viewport & responsiveness✓ HTTPS redirect
Accessibility (ADA) 8 checked clean
✓ Image alt text✓ Form field labels✓ Color contrast✓ Landmarks, headings & skip links✓ ARIA & focus order✓ Media captions & autoplay✓ Data table headers✓ Accessibility statement
Trust & substantiation 1 checked clean
✓ Unsubstantiated marketing claims

A read-only scan of observable behavior: we identified our crawler honestly and honored robots directives. Detection matches a known-vendor catalog (vendor terms as of June 2026), so absence of a finding is not proof a site is free of a given issue. Engine v0.2.0.

A

Appendices

Appendix — URLs Scanned

These results bind to exactly the 7 URLs below, as they existed on July 26, 2026 (engine v0.2.0). Pages not listed were not examined.

Appendix — Evidence record

A per-finding record of what was observed, on which pages, over which channels — captured July 26, 2026 by engine v0.2.0 on a read-only scan. Each item can be re-observed independently (see Verify this yourself). Raw request/identifier values are in the evidence CSV export. This documents our capture process and is not a legal conclusion.

Medium No SPF record — anyone can send email as clearsite-demo-ledger.vercel.app email-no-spf
Observed: no v=spf1 TXT record on clearsite-demo-ledger.vercel.app
Where: site-wide (a server/DNS setting, not a per-page fact)
Medium No DMARC record — forged email from clearsite-demo-ledger.vercel.app is delivered unchecked email-no-dmarc
Observed: no v=DMARC1 TXT record at _dmarc.clearsite-demo-ledger.vercel.app
Where: site-wide (a server/DNS setting, not a per-page fact)
Low No CAA record — any certificate authority can issue certs for clearsite-demo-ledger.vercel.app dns-no-caa
Observed: no CAA record for clearsite-demo-ledger.vercel.app
Where: site-wide (a server/DNS setting, not a per-page fact)
Low OCSP stapling is not enabled tls-no-ocsp
Observed: no stapled OCSP response during the handshake
Where: site-wide (a server/DNS setting, not a per-page fact)

Recommended next steps

We can remediate the 4 items identified above. To receive a prioritized remediation plan with timeline, contact ClearSite or reply to this report.

This is a point-in-time automated technical scan of observable website behavior on the specific URLs scanned, as they existed at the scan date shown — not a legal compliance audit or attestation, and not an audit, certification, or compliance opinion of any kind. Results describe only the pages scanned at that time; they are not an assessment of the business or entity operating the site, and must not be represented as current after the scan date. A "pass" means no high-priority technical issues were found at the scan threshold on the pages crawled — it does not certify HIPAA, ADA, or any regulatory compliance, and does not cover items unobservable from outside (signed vendor agreements, server configuration, internal policies). Form analysis covers each form's declared submission target; forms that submit via JavaScript to endpoints not visible in the page markup are not assessed. Third-party/tracker detection matches a known-vendor catalog, so absence of a finding is not proof a site is free of trackers. This report is general information about observable technical facts and is not legal advice, does not create an attorney-client or other professional relationship, and is not a substitute for review by a qualified attorney. For your specific legal obligations, consult an attorney licensed in your jurisdiction.
Full report · Assessment completeness: complete · Reference: 1100bed6-3f7d-4ea7-b1a6-5277349c9952 · Generated by ClearSite