NetspertsFull Diagnostic

harborviewdental.example

Checked November 10, 2026 at 3:00 PM UTC.

OverallAt risk

24Pass
12Needs attention
2At risk
2Could not confirm

Email protection

1.Approved senders are listed

Pass

What it means: Your domain says which mail services may send on its behalf.
What we found: v=spf1 include:_spf.mailhost.example include:spf.newsletter.example ~all

2.Message signing could not be confirmed

Could not confirm

What it means: Signing keys are stored under a name chosen by your mail provider. We tried 20 common names and none answered, which does not mean there is no key. Your mail provider can tell you the name.
What we found: Tried 20 common key names
How to fix it: Ask your email provider for the name of your signing key, then confirm that signing is switched on in its admin console. Once you know the name, this item can be confirmed.

3.Forgeries are reported but still delivered

Needs attention

What it means: The rule is set to watch only. Forged messages that pretend to come from your domain are still delivered to the people they were sent to.
What we found: v=DMARC1; p=none
How to fix it: Tighten the rule from watch-only to quarantine, then to reject, once the reports show that your real email passes.

Website protection

4.Website certificate is valid

Pass

What it means: Visitors get a secure connection. The certificate is good for another 212 days.
What we found: Issued by a public certificate company; expires in 212 days

5.Visitors are moved to the secure site

Pass

What it means: Anyone who types your address without https is sent on to the secure version.
What we found: Port 80 redirects to https

6.Two browser protections are missing

Needs attention

What it means: Your site does not send two of the four standard settings that block common website attacks, such as a page being shown inside someone else's page.
What we found: Missing: Content-Security-Policy, X-Frame-Options
How to fix it: Add the missing settings in your web host or web server configuration. On most hosts this is under an hour of work for a developer.

Website speed and search

7.Your server answers quickly

Pass

What it means: It started answering in 410 milliseconds, measured from our server.
What we found: First byte after 410 ms

8.The home page is light

Pass

What it means: It asks a visitor's browser to fetch 38 more files, which is a reasonable amount.
What we found: HTML 64 KB; 9 scripts, 4 stylesheets, 25 images

9.Pages are compressed in transit

Pass

What it means: Your server shrinks pages before sending them, so they arrive faster.
What we found: content-encoding: br

10.The page is set up for phones

Pass

What it means: It tells phones to fit the page to the screen.
What we found: viewport: width=device-width, initial-scale=1

11.No description for search results

Needs attention

What it means: Without one, search engines pick their own snippet of text to show under your name.
What we found: Title: "Harborview Dental | Family dentistry" (39 characters); description: none
How to fix it: Give the home page a title of about 50 to 60 characters and a description of about 150 characters that say what the business does and where.

12.No broken links found

Pass

What it means: We tested 12 links from your home page and each one led to a page.
What we found: 12 tested, 0 broken

Website software

13.No signs of a takeover were found

Pass

What it means: We looked at what a visitor sees on the home page (its title, description, headings, link text and text) for gambling, pill, counterfeit and adult spam, and for the pages that domain sellers and parking services show. None was found. A takeover that shows itself only to search engines, or only to visitors who arrive from a search, would not be seen here.
What we found: Nothing found in the title, description, headings, links or text

14.Your WordPress version (6.4.3) is behind

Needs attention

What it means: A newer release of WordPress is out (6.8.1). Updates carry security fixes, and the longer they wait, the more known problems an attacker can use.
What we found: generator tag: WordPress 6.4.3
How to fix it: Update the site's software to the current release after taking a backup. In WordPress that is Dashboard, then Updates. Switch on automatic updates for security releases. If someone else built the site, ask them to do it, and ask who looks after updates from now on.

15.2 of 6 plug-ins appear to be behind the current release

Needs attention

What it means

Plug-ins are the most common way into a WordPress site, because each one is separate code that needs its own updates. We cannot tell from outside which old versions are dangerous, so treat this as a list to update.

What we found

6 plug-ins with a readable version; 2 behind

Behind

a booking calendar plug-in: seen 4.1, current 4.9
a contact form plug-in: seen 5.7, current 6.0

How to fix it

In the WordPress dashboard, open Plugins, update each one that offers an update, and delete any you do not use, because an unused plug-in can still be broken into. Switch on automatic updates for the ones you keep. Replace any plug-in that has been withdrawn from the WordPress directory.

16.Your server announces PHP 7.4.33, which is no longer supported

At risk

What it means: Support for PHP 7.4 ended on 2022-11-28, so the PHP project no longer publishes security fixes for it. Some hosts keep patching old versions themselves, so ask your host before assuming the worst.
What we found: x-powered-by: PHP/7.4.33
How to fix it: Ask your web host to move the site to a supported version of PHP. Most hosts have a setting for it in their control panel. Test the site afterwards, because old plug-ins and themes can break on a newer version. Ask the host to stop the server announcing its version as well.

Trackers and privacy

17.2 well-known trackers load with your home page

Pass

What it means

These measure visits or load other tools, and none of them is for advertising. The list is what the page itself loads; a tag manager or a click can add more later.

What we found

A visit counter, a tag manager

Found

A visit counter (analytics)
A tag manager (can load other trackers)

18.1 cookie set when the page first loads

Pass

What it means: These look like the kind a site sets to work, such as sign-in, security or language, but we have not confirmed each one. Cookies that scripts set after the page loads are not seen.
What we found: Cookie names: session

19.Your home page links to a privacy page

Pass

What it means: We checked only that the link is there, not what the page says.
What we found: Link: /privacy

20.Trackers load and no consent notice was found

Needs attention

What it means: Whether a notice is required depends on where your visitors are: the EU, the UK and some US states have rules. This is not legal advice. A notice built by hand would not be recognised by this check.
What we found: Trackers: 2; no consent tool recognised
How to fix it: Add a consent tool that asks visitors before trackers load. Several have free plans for small sites, and most website builders have one built in. An attorney can tell you which rules apply to your visitors.

Accessibility basics

21.4 of 25 pictures have no description

Needs attention

What it means

Screen readers read out a picture's description. Without one, a visitor who cannot see it gets nothing, or the file name.

What we found

4 pictures with no alt attribute

Examples

team-photo-2.jpg
waiting-room.jpg
banner-spring.png
map-small.png

How to fix it

Add a short description (alt text) to each picture that carries meaning, saying what it shows. Mark purely decorative pictures as decorative with an empty description. Most website builders have a field for this on each picture.

22.Every form field has a label

Pass

What it means: Each of the 3 form fields on the home page is tied to a label. Automated checks find only some accessibility problems, colour contrast is not checked, and a clean result is not a statement of compliance with any accessibility standard or law.
What we found: 3 fields, 3 labelled

23.The page declares its language

Pass

What it means: The page says it is in "en-US". Automated checks find only some accessibility problems, and a clean result is not a statement of compliance with any accessibility standard or law.
What we found: lang="en-US"

24.Every link has words

Pass

What it means: Each of the 41 links on the home page has text, a label or a described picture. Automated checks find only some accessibility problems, and a clean result is not a statement of compliance with any accessibility standard or law.
What we found: 41 links, 0 without words

25.The headings are in order

Pass

What it means: The page has a main heading and no skipped levels. Automated checks find only some accessibility problems, and a clean result is not a statement of compliance with any accessibility standard or law.
What we found: 1 h1, 6 h2, 4 h3

Domain registration

26.Your domain is registered until 2028-04-19

Pass

What it means: The registration has 525 days left, so there is no near-term risk of it lapsing.
What we found: Expires 2028-04-19

27.Your domain is locked against being moved away

Pass

What it means: The registry shows a transfer lock, so the domain cannot be moved to another registrar without your unlocking it.
What we found: clientTransferProhibited

Lookalike domains

28.1 lookalike address set up for email

At risk

What it means

Someone else has registered an address that reads like yours at a glance and has set it up to send and receive email. That is how fake invoices and fake requests to your clients are sent.

What we found

112 variations tried; 3 registered by others; 1 set up for email

Registered by others

harborvlewdental.example (a letter swapped): registered, has a website, set up for email
harborview-dental.example (a hyphen added): registered, no website
harborviewdentist.example (another word): registered, no website

How to fix it

Open each address to see who is behind it. Register the closest unclaimed variations yourself, which costs about $15 a year each. If one imitates your firm, report it to the company it is registered with and warn your staff and customers. Tell staff to check the sender's address on any message about payments.

Email delivery

29.Your domain is not on the domain blocklists that answered

Pass

What it means: Spam blocklists decide whether your messages reach inboxes. None of the lists that answered has your domain.
What we found: 2 of 3 lists answered; none lists the domain

30.Mail server blocklists did not answer

Could not confirm

What it means: Blocklists limit questions that come through shared networks, and a refusal looks the same as "not listed" unless it is checked for. These lists refused to answer, so nothing can be said about your mail servers from them.
What we found: 0 of 5 lists answered

31.Your approved-sender list is within the limit

Pass

What it means: The list needs 6 lookups, and receiving servers allow 10. Past the limit, your list stops working.
What we found: 6 of 10 lookups

32.Your mail servers exist

Pass

What it means: Each mail server named in your records answers to its name, so mail has somewhere to go.
What we found: 2 mail servers

Domain hardening

33.Mail to your domain is not required to travel encrypted

Needs attention

What it means: Most mail is encrypted on its way anyway, but without MTA-STS an attacker who sits in the path can strip the encryption and read or change the mail. This is extra hardening that most small firms have not set up. It is not a fault, and not an emergency.
What we found: No MTA-STS record
How to fix it: Ask your email provider or IT person to set up MTA-STS for the domain: a short policy file at a web address, and one DNS entry. Start in testing mode, then switch to enforce. Microsoft 365 and Google Workspace both publish step-by-step instructions.

34.Your domain's records are not signed

Needs attention

What it means: Signing the domain's records stops forged DNS answers, which could send your visitors or your mail somewhere else. This is extra hardening that most small firms have not set up. It is not a fault, and not an emergency.
What we found: No DS record
How to fix it: Switch on DNSSEC where your domain's DNS is managed. With most providers it is one switch. If the DNS is hosted somewhere other than where the domain is registered, the registrar also needs a record (DS) from the DNS host. A mistake here can take the domain offline, so have whoever manages your DNS do it.

35.Any certificate company may issue a certificate for your domain

Needs attention

What it means: Without a CAA entry, any certificate company may issue a certificate for the domain, and a mistake or a trick at one of them could give someone a certificate they should not have. This is extra hardening that most small firms have not set up.
What we found: No CAA entry
How to fix it: Add a CAA entry in your DNS that names the certificate company your website uses; your web host can tell you which. It stops any other company issuing a certificate for your domain.

What outsiders can learn about your firm

36.Your public records name 5 outside services

Pass

What it means

These are visible to anyone. Each is a name an attacker can borrow for a convincing fake message, so staff should know which the firm really uses. If any on the list is no longer used, its record should be removed.

What we found

5 services

Services

A business email service (email; seen in MX, SPF)
A newsletter service (marketing; seen in SPF)
An online booking service (other; seen in SPF)
A search-visibility tool (verification record; seen in TXT)
A document-signing service (documents; seen in TXT)

37.3 staff email addresses can be collected from your website

Pass

What it means: Anyone can collect these addresses without visiting your office, and that is where phishing lists start: a named address on a team page is the first to receive the fake invoice. A handful is normal for a small firm. The addresses themselves are shown to buyers who confirm an address at the domain. Only the home page and up to four linked pages were read, and addresses that scripts add later or that are protected against collection are not seen, so read this as "at least this many".
What we found: 3 named, 2 shared, 1 address at another domain; read the home page and 3 of 4 linked pages

AI visibility

38.AI assistants are allowed to read your site

Pass

What it means: Your robots.txt does not block the 13 AI crawlers we checked, so assistants can read your pages when someone asks about you.
What we found: 0 of 13 crawlers blocked

39.Your site does not state its business details as data

Needs attention

What it means: The page reads fine as text, but it carries no structured data naming the business, its address and its hours. Assistants and search engines then have to guess these from the words on the page.
What we found: 812 words of readable text; structured data: none; description: no
How to fix it: Put the firm's name, what it does, where it is and how to reach it in plain text on the home page, add a short description, and add the same details as structured data. A developer can do this in an hour.

40.Claude found your site but relied on other sources

Needs attention

What it means: We asked Claude, with web search on: "What can you tell me about the business at harborviewdental.example? What does it do, where is it based, and how would I contact it?" Assistants word things differently each time and can be wrong, so read the answer as what a customer might be told.
What we found: 3 sources read; your own site was found but not cited
What Claude said: Harborview Dental appears to be a small family dental practice. Directory listings describe general and cosmetic dentistry and give a phone number, though they disagree about opening hours. I could not confirm the practice's street address from a source I trust, so I would check the practice's own website before visiting.
How to fix it: Make the home page say plainly what the firm does, where, and how to reach it, and add the same details as structured data. Keep the name, address and phone number identical on your Google Business Profile and directory listings, which assistants draw on.

Recommended order of work

Your server announces PHP 7.4.33, which is no longer supported (item 16). Ask your web host to move the site to a supported version of PHP. Most hosts have a setting for it in their control panel. Test the site afterwards, because old plug-ins and themes can break on a newer version. Ask the host to stop the server announcing its version as well.
1 lookalike address set up for email (item 28). Open each address to see who is behind it. Register the closest unclaimed variations yourself, which costs about $15 a year each. If one imitates your firm, report it to the company it is registered with and warn your staff and customers. Tell staff to check the sender's address on any message about payments.
Forgeries are reported but still delivered (item 3). Tighten the rule from watch-only to quarantine, then to reject, once the reports show that your real email passes.
Two browser protections are missing (item 6). Add the missing settings in your web host or web server configuration. On most hosts this is under an hour of work for a developer.
No description for search results (item 11). Give the home page a title of about 50 to 60 characters and a description of about 150 characters that say what the business does and where.
Your WordPress version (6.4.3) is behind (item 14). Update the site's software to the current release after taking a backup. In WordPress that is Dashboard, then Updates. Switch on automatic updates for security releases. If someone else built the site, ask them to do it, and ask who looks after updates from now on.
2 of 6 plug-ins appear to be behind the current release (item 15). In the WordPress dashboard, open Plugins, update each one that offers an update, and delete any you do not use, because an unused plug-in can still be broken into. Switch on automatic updates for the ones you keep. Replace any plug-in that has been withdrawn from the WordPress directory.
Trackers load and no consent notice was found (item 20). Add a consent tool that asks visitors before trackers load. Several have free plans for small sites, and most website builders have one built in. An attorney can tell you which rules apply to your visitors.
4 of 25 pictures have no description (item 21). Add a short description (alt text) to each picture that carries meaning, saying what it shows. Mark purely decorative pictures as decorative with an empty description. Most website builders have a field for this on each picture.
Mail to your domain is not required to travel encrypted (item 33). Ask your email provider or IT person to set up MTA-STS for the domain: a short policy file at a web address, and one DNS entry. Start in testing mode, then switch to enforce. Microsoft 365 and Google Workspace both publish step-by-step instructions.
Your domain's records are not signed (item 34). Switch on DNSSEC where your domain's DNS is managed. With most providers it is one switch. If the DNS is hosted somewhere other than where the domain is registered, the registrar also needs a record (DS) from the DNS host. A mistake here can take the domain offline, so have whoever manages your DNS do it.
Any certificate company may issue a certificate for your domain (item 35). Add a CAA entry in your DNS that names the certificate company your website uses; your web host can tell you which. It stops any other company issuing a certificate for your domain.
Your site does not state its business details as data (item 39). Put the firm's name, what it does, where it is and how to reach it in plain text on the home page, add a short description, and add the same details as structured data. A developer can do this in an hour.
Claude found your site but relied on other sources (item 40). Make the home page say plainly what the firm does, where, and how to reach it, and add the same details as structured data. Keep the name, address and phone number identical on your Google Business Profile and directory listings, which assistants draw on.

About this report: it is a snapshot taken at the time shown. The lookalike check covers the common variations of your address, not every possible one. The blocklist results cover the lists that answered. Some endings (.us, .co, .io and .de among them) do not offer the public registration lookup, so expiry and lock can be "could not confirm". The website software check reads only what the home page reveals, so a hidden version is "could not confirm", not "current". The tracker check reads the page as delivered and is not legal advice. The domain hardening items are extra protection that most small firms have not set up; they are not faults. The accessibility items come from automated checks of the home page as delivered, which find only some accessibility problems. Colour contrast is not checked, and a clean result is not a statement of compliance with any accessibility standard or law. The services list is read from public records, covers the common services only, and cannot tell which ones are still in use. The staff-address count covers the home page and a few linked pages only. An AI assistant words its answer differently each time. "Could not confirm" means the answer could not be established, not that something is wrong. This is not a full security audit.