Palisadium
Portfolio

What an audit looks like.

Every audit below is a passive scan of a publicly accessible website, run with our scanner. Findings are evidence-backed — each one quotes a missing DNS record or an absent HTTP header, so you can check the source yourself. Reordered highest-risk first.

How to read these

Passive means we don't touch the site.

A passive scan looks at what a site publishes to the public internet — DNS records, HTTP headers, page content. We don't attempt logins, don't fuzz inputs, don't probe ports. Every finding quotes its evidence.

Sample audits — verified 2026-10-10

Five sites, run through the same scanner

jamesford.co.uk · UK bespoke menswear · London

jamesford.co.uk

2 high · 0 medium · 0 low · 2 total
  • HighDMARC not configured

    The domain has no _dmarc TXT record. DMARC is what lets recipients verify that email claiming to be from your domain actually came from you. Without it, anyone can send email that looks like it came from jamesford.co.uk, and Gmail/Outlook won't flag it. For a site taking customer orders, that means someone could spoof a "your order has shipped" email and ask customers to click a fake link.

    DNS lookup of _dmarc.jamesford.co.uk returns no answer.
  • HighHTTP does not redirect to HTTPS

    Visiting http://jamesford.co.uk/ serves the full site over plain HTTP with status 200 — no redirect to https://. This means a man-in-the-middle attacker on a public Wi-Fi can intercept the entire page load, inject scripts, and steal session cookies. The HTTPS version exists and works, but browsers only use it if you type https:// yourself.

    curl -I http://jamesford.co.uk/ → HTTP/1.1 200 OK, no Location: header.
honestbee.com · UK beekeeping supply

honestbee.com

1 high · 1 medium · 0 low · 2 total
  • HighDMARC not configured

    No _dmarc TXT record. Same exposure as jamesford.co.uk: anyone can send email that appears to come from honestbee.com, and recipients have no cryptographic way to tell the difference. Particularly risky because the site handles customer accounts.

    DNS lookup of _dmarc.honestbee.com returns no answer.
  • MediumDKIM not configured

    No default._domainkey TXT record. DKIM signs outbound mail so recipients can verify it wasn't tampered with. Without it, even mail sent from the legitimate server can't be cryptographically attributed to the domain.

    DNS lookup of default._domainkey.honestbee.com returns no answer.
barbour.com · UK heritage outerwear

barbour.com

0 high · 1 medium · 1 low · 2 total
  • Medium4 security headers missing

    The site sends content-security-policy and x-content-type-options but is missing HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Without HSTS, visitors can be silently downgraded to HTTP by a man-in-the-middle. Without X-Frame-Options, the site can be embedded in an iframe on a malicious page (click-jacking). Without Referrer-Policy, browsing history leaks to third parties. Without Permissions-Policy, browser features (camera, mic, location) aren't restricted.

    curl -I https://barbour.com/ shows content-security-policy and x-content-type-options only.
  • LowDKIM not configured

    No default._domainkey TXT record. DKIM isn't configured for outbound mail authentication. The SPF record is hard-fail (-all) and DMARC exists, but DMARC is currently monitor-only (p=none) so there's no enforcement yet.

    DNS lookup of default._domainkey.barbour.com returns no answer.
oakley.com · global luxury eyewear

oakley.com

0 high · 1 medium · 2 low · 3 total
  • MediumDKIM not configured

    No default._domainkey TXT record. Same gap as other sites: outbound mail can't be cryptographically attributed to the domain.

    DNS lookup of default._domainkey.oakley.com returns no answer.
  • LowSPF policy is soft-fail

    The SPF record ends with ~all instead of -all. Soft-fail means mail from unknown servers is accepted but flagged for later review; hard-fail rejects it outright. A spoof-friendly posture.

    SPF: v=spf1 include:%{ir}... ~all
  • Low2 security headers missing

    Missing referrer-policy and permissions-policy. Browsing history and browser feature access aren't restricted. The other headers (CSP, X-Frame-Options, HSTS, X-Content-Type-Options) are all present.

    curl -I https://oakley.com/ shows CSP, X-Frame-Options, HSTS, X-Content-Type-Options present.
johnlewis.com · UK department store

johnlewis.com

0 high · 1 medium · 0 low · 1 total
  • MediumDKIM not configured

    No default._domainkey TXT record. The mail-side posture is otherwise solid — SPF hard-fails and DMARC is set to p=quarantine — but DKIM is the missing piece of the authentication chain.

    DNS lookup of default._domainkey.johnlewis.com returns no answer.

These five are sample audits, not client work. They're here so you can see the shape of what we deliver before we talk.

Get your own audit

A written report, delivered in 3 working days.

£250 one-off. Email us your domain and we'll send the report back with every finding quoted against its evidence.

Request an audit See pricing
About going deeper. The audits shown above are passive — they only look at what a site publishes to the public internet. If you'd like us to go further (checking for known vulnerability signatures, testing form inputs for injection, verifying TLS configuration in detail), submitting a request through “Request an audit” gives us your written permission to do that deeper work on your site. We won't probe without that permission, and we won't ask for credentials at any point.