davidyao.me

HTML metadata

Technology

Server

nginx

Analytics

• Google Tag Manager

Fonts

• Google Fonts

Third-party hosts loaded (3)

• documentservices.adobe.com×1
• fonts.googleapis.com×1
• www.googletagmanager.com×1

Social

• linkedin
• github
• facebook
• youtube

DNS records live

NS

• dns1.registrar-servers.com
• dns2.registrar-servers.com

MX

• 10 eforward1.registrar-servers.com
• 10 eforward2.registrar-servers.com
• 10 eforward3.registrar-servers.com
• 15 eforward4.registrar-servers.com
• 20 eforward5.registrar-servers.com

Verified for

• Google

Email authentication weak

SPF

v=spf1 include:spf.efwd.registrar-servers.com ~all

softfail (~all)

DMARC

not published

DKIM

no key found at common selectors

Certificate (current)

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 30/100 Checked live page: https://davidyao.me/

findings

• missing HSTS
• missing Content Security Policy
• missing frame protection
• missing content type protection
• missing Referrer Policy
• missing Permissions Policy

Links to (27)

• facebook.com×2
• github.com×2
• github.io×2
• google.com×2
• ieee.org×2
• imdb.com×2
• letterboxd.com×2
• linkedin.com×2
• mongodb.com×2
• ohadf.com×2
• oxfordjournals.org×2
• qlu-lab.org×2
• runwayml.com×2
• siggraph.org×2
• springer.com×2
• tianyuliu.com×2
• wikipedia.org×2
• willcrichton.net×2
• yiminghu.net×2
• youtube.com×2
• acm.org×2
• anhtruong.org×2
• arxiv.org×2
• danfu.org×2
• douban.com×2
• douyin.com×2
• envymycarbook.com×2

Linked from (1)

• ohadf.com×2