xmcyber.com

HTML metadata

Title

Continuous Exposure Management | XM Cyber

Description

Illuminate and disrupt the attack paths leading to your critical assets, in the cloud or on-premises.

Language

en-US

Generator

WPML ver:4.6.3 stt:1,4,3,66;

Canonical

https://xmcyber.com/

Translations

de
en
fr
jp

Open Graph

url: https://xmcyber.com/
title: Continuous Exposure Management | XM Cyber
locale: en_US
site name: XM Cyber
description: Fix What Matters with an innovative, threat-led approach to Vulnerability Management.

Technology

CDN: Cloudflare
CMS: WordPress

Analytics

Google Analytics
Google Tag Manager
Hotjar

Ads

Google Ads (DoubleClick)
Meta Pixel

Cookie consent

OneTrust

Third-party hosts loaded (21)

js.hs-scripts.com×3
analytics.ahrefs.com×2
cdn.cookielaw.org×2
www.googletagmanager.com×2
12137400.fls.doubleclick.net×1
connect.facebook.net×1
gmpg.org×1
googleads.g.doubleclick.net×1
js-eu1.hs-analytics.net×1
js-eu1.hs-banner.com×1
js-eu1.hs-scripts.com×1
js-eu1.hsadspixel.net×1
js-eu1.hubspot.com×1
script.hotjar.com×1
snap.licdn.com×1
static.ads-twitter.com×1
static.hotjar.com×1
trinitymedia.ai×1
trk.techtarget.com×1
vd.trinitymedia.ai×1
www.google-analytics.com×1

Social

Registration

Registrar

GoDaddy.com, LLC

Created

2016-08-25

Expires

2026-08-25 98 days left

Updated

2024-08-22

Name servers

algin.ns.cloudflare.com
liv.ns.cloudflare.com

DNS records live

NS

algin.ns.cloudflare.com
liv.ns.cloudflare.com

MX

0 inbound-smtp.eu-west-1.amazonaws.com
10 aspmx.l.google.com
20 alt1.aspmx.l.google.com
30 alt2.aspmx.l.google.com
40 aspmx2.googlemail.com
50 aspmx3.googlemail.com

TXT

Show 18 TXT records

30FE6CB37D
IDj3bkllet5sar75b28cr1josrfp
ZOOM_verify_X_YWM1tWSgKbLUzJsHPQQA
google-site-verification=Pl6SNe4RwzvQTzFigP9Mhjf4Mc_8yRqnuCrvofbUXEA
MS=ms71545487
ppe-47600497185c6d7e25c4
apple-domain-verification=lk2xvchoGKkG4yUn
figma-domain-verification=6580d43a8f7e397ae29560f9d4b997fb8d4a47f49fd1e975e496e80c9d457cc8-1763381329
v=verifydomain MS=2459886
2ACE0BB18E
dust-domain-verification-kx8xg8=UIKXCgDeV6EsJojqF31AfTMsL
google-site-verification=W_J54LByNi5UCW1f1LzEp_DOsOMwnvu_XfTm7UdnyN0
vmware-cloud-verification-7b511889-2ad8-48db-ad58-0b18b523eb60
mongodb-site-verification=TNSJKKRBtJcnBhY9WV4CjMd84jsnAHUG
google-site-verification=V2r4sofD_TXCMz9yfCilWtM2d0TklZsC-s5Z6F4mLGg
google-site-verification=qTEXJ5FYQKm8AImB-kKnQQPHN067ebdqp6cGgTYqrsA
slack-domain-verification=TkU9nMuUox3OoV0cNwUVmtlNSXXISlv7WUo7bi4Q
cloudflare_dashboard_sso=1306c456b62a04f69f1eb022c596ebfd

Email authentication strong

SPF

v=spf1 include:_spf.google.com include:spf.ironscales.com include:_spf.salesforce.com include:4156399.spf03.hubspotemail.net ip4:212.179.195.2 ip4:34.242.173.204 include:docebosaas.com -all

strict (-all)

DMARC

v=DMARC1;p=quarantine;pct=100;rua=mailto:bounce@xmcyber.com

policy: quarantine

DKIM

google: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqL8wkjyO3bOvLFG5h2Hqypk80WBTAXlcFLeol0n5xDgMfYXq6Pa6TTC1PPmn8EVgJu335otL16vxax…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoT5iAs4GI1IpuVvUQM2oYjo+Y8bQ1EQxv5EvSI2dEygVS44+Wws5YTil+zGH+lNt2bbqIZwJfRA5UVvtUp…
s2: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA12Nh5Hqxv2Kbor2QUPWfMkPo1rqXS7d86osjzF7sNOD5OZKu95p7fSCdi4BM/SCVHY6bG11x/3qp2jpyKu…
smtpapi: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPtW5iwpXVPiH5FzJ7Nrl8USzuY9zqqzjE0D1r04xDN6qwziDnmgcFNNfMewVKN2D1O+2J9N14hRprzByFwfQW76…

selectors probed

Certificate (current)

WE1

from 2026-03-23 to 2026-06-22

Expires in 34 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://xmcyber.com/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources

Header values

referrer-policy: strict-origin-when-cross-origin
x-frame-options: sameorigin
permissions-policy: autoplay=*, camera=(self) , cross-origin-isolated=*, display-capture=(self), document-domain=*, encrypted-media=*, geolocation=*, keyboard-map=*, microphone=(self), payment=(self), sync-xhr=*, fullscreen=*
x-content-type-options: nosniff
content-security-policy: script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://*.hsforms.net https://www.googletagmanager.com https://analytics.ahrefs.com https://cdn.cookielaw.org https://*.hs-scripts.com https://js-eu1.hsadspixel.net https://js-eu1.hs-banner.com https://js-eu1.hs-analytics.net https://calendly.com https://www.google-analytics.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://trk.techtarget.com https://connect.facebook.net https://js-eu1.hubspot.com https://script.hotjar.com https://js.zi-scripts.com https://assets.trendemon.com https://trackingapi.trendemon.com https://www.comeet.co https://assets.calendly.com https://googleads.g.doubleclick.net https://trinitymedia.ai https://static.addtoany.com https://vd.trinitymedia.ai https://cdn.id5-sync.com; frame-ancestors 'self';
strict-transport-security: max-age=31536000