Website check
phantom.com
In plain English
Overall, phantom.com scores a B (83/100). The site has a few missing protective settings, but none of the findings show an active break-in or a compromised site. The most important fix is adding an HSTS header so browsers always use HTTPS, since this closes the chance of a visitor being pushed onto an unencrypted connection on public Wi-Fi. Visitors do not need to panic, but the owner should add HSTS and a full Content Security Policy, and consider blocking the page from being framed by other sites.
No HSTS header
Without HSTS, a visitor's first connection can be quietly downgraded to plain HTTP on hostile Wi-Fi, exposing what they send.
How to fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response.
No Content Security Policy
The site only has a report-only policy, which watches for injected scripts but does not block them.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
report-only: frame-ancestors 'self'; report-uri https://rt.phantom.app/csp
Page can be framed by other sites
Another site could load this page in a hidden frame and trick visitors into clicking things (clickjacking).
How to fix: Send X-Frame-Options: DENY (or SAMEORIGIN), or add a frame-ancestors rule to the Content Security Policy.
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No CAA record
CAA records limit which certificate authorities may issue certificates for phantom.com, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up phantom.com and connecting over HTTPS
- 03Connected over HTTPS: phantom.com answered 200
- 04Certificate from Google Trust Services, valid 84 more days (TLSv1.3)
- 05Read the security headers: nosniff, Referrer-Policy set; missing HSTS, CSP, X-Frame-Options
- 06Checked 5 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 1 script source from other sites
- 09Plain http:// redirects to HTTPS
- 10Old TLS 1.0/1.1: refused
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 83/100, grade B. Writing it up in plain English
Technical details (27)
- ip
- 104.18.40.111
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- phantom.com
- tls validTo
- 2027-01-14T22:11:19.000Z
- tls daysLeft
- 84
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf.google.com include:amazonses.com include:sendgrid.net -all
- email apex
- phantom.com
- email dmarc
- v=DMARC1;p=reject;pct=100;rua=mailto:0d7fd79b732f4bf6a2c634b4ad5cc1e0@dmarc-reports.cloudflare.net, mailto:dmarc@5pu6xbrx.uriports.com;ruf=mailto:dmarc@5pu6xbrx.uriports.com;ri=86400;aspf=r;adkim=r;fo=1
- status
- 200
- cookies
- lng, csrf, country-suggested-locale, country-code, __cf_bm
- headers server
- cloudflare
- headers referrer-policy
- strict-origin-when-cross-origin
- headers x-content-type-options
- nosniff
- finalUrl
- https://phantom.com/
- requests
- 3
- timingMs
- 393
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- cdn.cookielaw.org
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.