xyplanningnetwork.com

HTML metadata

Title: Fee-Only Financial Planning Made Possible with XYPN
Description: XYPN makes it possible for fee-only financial advisors to start, run, and scale the RIA of their dreams with complete autonomy.
Language: en
Generator: HubSpot
Canonical: https://www.xyplanningnetwork.com

Open Graph

url: https://www.xyplanningnetwork.com
title: Fee-Only Financial Planning Made Possible with XYPN
site name: XYPN
description: XYPN makes it possible for fee-only financial advisors to start, run, and scale the RIA of their dreams with complete autonomy.

Technology

CDN: Cloudflare

Analytics

Google Tag Manager

Fonts

Google Fonts

Third-party hosts loaded (4)

fonts.googleapis.com×3
www.googletagmanager.com×2
fonts.gstatic.com×1
www.facebook.com×1

Social

Registration

Registrar

GoDaddy.com, LLC

Created

2014-01-24

Expires

2027-01-24 250 days left

Updated

2026-01-25

Name servers

ns15.domaincontrol.com
ns16.domaincontrol.com

DNS records live

NS

ns15.domaincontrol.com
ns16.domaincontrol.com

MX

10 aspmx.l.google.com
20 alt1.aspmx.l.google.com
20 alt2.aspmx.l.google.com
30 aspmx2.googlemail.com
30 aspmx3.googlemail.com

TXT

Show 17 TXT records

google-site-verification=L5wIHFnYxgCcKJ08ItBOiMlEh7BQ2x3Y-k6A_oRqp_s
MS=F3CF06C598D4A4BE0F2852E013ED5481C2EB0A38
notion-domain-verification=yAoHpSnZcRfNWDax9a7trQMIhrafVXE29oNwomiyb47
canva-site-verification=OJuUQT-pBqYOsKgjEMuk8g
google-site-verification=-HQIKSeVFpAkMoU522PV4v8f4oRkOYRRia5MSB98Ftg
google-site-verification=1Du7h1oeUNnivPG-vm_Xl8BxYmRZ5DfL1WRNtrQPo3k
google-site-verification=1h-SxDkdqaD-CJLufCqT8cmb2tV4LbH1Jc-hCHxphU0
facebook-domain-verification=wjhazwttcs9zuuka2ux2u6u6ci0amm
apple-domain-verification=Ir5LWnDGFZoW6mFA
box-domain-verification=555877dadd26c0816e7685d294f8eb36f14d5602db5d73f1d236fb06de08e78b
MS=ms71766494
google-site-verification=VHf88bSBeYmvCgBHnOnc92HMO2GqKHfvbp_qCuZhbV0
google-site-verification=YT4Cw08qslYLSyiT84RfXXftYVo2TuqeKInKxY-Jzus
ZOOM_verify_4AEOstVHG0PqitbxtRuG8P
google-site-verification=GhV-BveYwnZfgyEoP5r6ua2gzsmaOIMmBAmDPJ8Cr9E
zoom-domain-verification=ZOOM_verify_2f5d07d766f648e78db81e8bde5eb01b
google-site-verification=3fh4Q_YzM5Nr6O1ljGoB8xhKBLs64G73k3gWqr5i-3Y

Email authentication strong

SPF

v=spf1 include:_spf.google.com include:docebosaas.com include:2275467.spf03.hubspotemail.net ~all

softfail (~all)

DMARC

v=DMARC1; p=reject; rua=mailto:postmaster@xyplanningnetwork.com, mailto:dmarc@u4xsfpmk.uriports.com; ruf=mailto:dmarc@u4xsfpmk.uriports.com; pct=100; adkim=r; aspf=r; fo=1:d:s

policy: reject (enforced)

DKIM

google: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr68m4ktXQj8wcB8y3LA+miANtAp2PjqfPdxIdnqe5gQKRWownk1En5d1j1r9rbET+uT/0cv7Q509XJ…
smtpapi: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPtW5iwpXVPiH5FzJ7Nrl8USzuY9zqqzjE0D1r04xDN6qwziDnmgcFNNfMewVKN2D1O+2J9N14hRprzByFwfQW76…

selectors probed

Certificate (current)

WE1

from 2026-05-12 to 2026-08-10

Expires in 83 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 80/100 Checked live page: https://www.xyplanningnetwork.com/

present

strict-transport-security
content-security-policy
content-security-policy-report-only
x-frame-options
x-content-type-options
referrer-policy

findings

short HSTS max-age
CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing Permissions Policy

Header values

referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-security-policy: script-src 'self' 'unsafe-inline' *.xyplanningnetwork.com *.google.com *.gstatic.com *.googletagmanager.com *.googleapis.com googleapis.com *.cloudfront.net cloudfront.net *.cloudflare.com *.clarity.ms c.bing.com *.facebook.net *.facebook.com *.jsdelivr.net *.hubspot.com *.libsyn.com *.wistia.com browser.sentry-cdn.com *.doubleclick.net *.hsappstatic.net *.hubspotusercontent20.net *.hubspotusercontent-na1.net *.hscollectedforms.net *.usemessages.com *.hsleadflows.net *.hs-scripts.com *.hsadspixel.net *.hs-analytics.net *.hs-banner.com *.hs-banner.net *.hsforms.net *.hsforms.com *.hubspotvideo.com *.hubspotfeedback.com *.hubapi.com *.unpkg.com *.whova.com https://whova.com *.google-analytics.com; img-src 'self' data: *.xyplanningnetwork.com *.gstatic.com *.google-analytics.com *.s3.us-west-2.amazonaws.com *.wistia.com *.hsforms.net *.googleapis.com *.googletagmanager.com *.rogerdooley.com *.bing.com *.clarity.ms *.hubspot.com *.hubspot.net *.hubspotusercontent20.net *.googleuserconten
strict-transport-security: max-age=3628800; includeSubDomains
content-security-policy-report-only: script-src 'self' 'unsafe-inline' *.xyplanningnetwork.com *.google.com *.gstatic.com *.googletagmanager.com *.googleapis.com googleapis.com *.cloudfront.net cloudfront.net *.cloudflare.com *.clarity.ms c.bing.com *.facebook.net *.facebook.com *.jsdelivr.net *.hubspot.com *.libsyn.com *.wistia.com browser.sentry-cdn.com *.doubleclick.net *.hsappstatic.net *.hubspotusercontent20.net *.hubspotusercontent-na1.net *.hscollectedforms.net *.usemessages.com *.hsleadflows.net *.hs-scripts.com *.hsadspixel.net *.hs-analytics.net *.hs-banner.com *.hs-banner.net *.hsforms.net *.hsforms.com *.hubspotvideo.com *.hubspotfeedback.com *.hubapi.com *.unpkg.com *.whova.com https://whova.com *.google-analytics.com; img-src 'self' data: *.xyplanningnetwork.com *.gstatic.com *.google-analytics.com *.s3.us-west-2.amazonaws.com *.wistia.com *.hsforms.net *.hubspotusercontent20.net *.googleapis.com *.googletagmanager.com *.rogerdooley.com *.bing.com *.clarity.ms *.hubspot.com *.hubspot.net *.googleuserconten