passkeys.dev

.dev crawl

First seen 2026-04-14 · Last seen 2026-05-14 · ok HTTP/1.1 200 1610 ms crawled 2026-05-07

US · 104.26.2.120 · AS13335 Cloudflare, Inc.

Reputation 100/100

Classifying

HTML metadata

Title

passkeys.dev - Passkeys Developer Resources

Description

Hello passkeys! Goodbye passwords.

Language

Generator

Hugo 0.158.0

Feeds

RSS RSS

Open Graph

url: https://passkeys.dev/
title: Passkeys Developer Resources
locale: en_US
site name: passkeys.dev
description: Hello passkeys! Goodbye passwords.

Technology

CDN: Cloudflare
CMS: Hugo

Analytics

Cloudflare Insights

Third-party hosts loaded (1)

static.cloudflareinsights.com×2

Social

DNS records live

NS

destiny.ns.cloudflare.com
shane.ns.cloudflare.com

MX

32 route3.mx.cloudflare.net
78 route2.mx.cloudflare.net
90 route1.mx.cloudflare.net

TXT

google-site-verification=LJbnt4DuMJOkj8pwfX-XzF9-uPfoaRFao35-ajzyGwI

Email authentication strong

SPF

v=spf1 include:_spf.mx.cloudflare.net ~all

softfail (~all)

DMARC

v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:tim@cloudauth.dev

policy: reject (enforced) · sp=reject

DKIM

default: v=DKIM1; p=
google: v=DKIM1; p=
selector1: v=DKIM1; p=
selector2: v=DKIM1; p=
k1: v=DKIM1; p=
k2: v=DKIM1; p=
mail: v=DKIM1; p=
dkim: v=DKIM1; p=
s1: v=DKIM1; p=
s2: v=DKIM1; p=
mxvault: v=DKIM1; p=
smtpapi: v=DKIM1; p=

selectors probed

Certificate (current)

WE1

from 2026-04-18 to 2026-07-17

Expires in 60 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 85/100 Checked live page: https://passkeys.dev/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing Permissions Policy

Header values

referrer-policy: strict-origin
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' *.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' cloudflareinsights.com; manifest-src 'self'
strict-transport-security: max-age=31536000; includeSubDomains; preload