Executive Summary
High-level findings and risk assessment for autographman.co.uk
This assessment identified 17 findings across email authentication, DNS infrastructure, web security, and compliance alignment for autographman.co.uk. The domain benefits from Shopify's managed infrastructure with Cloudflare CDN/WAF, TLS 1.3, and reasonable security headers (4 of 9 present). However, email security has critical gaps — no DKIM records despite using Amazon SES, SPF uses softfail instead of hardfail, and DMARC is set to quarantine without aggregate reporting. The domain expires in 90 days and should be renewed promptly. The site is clean on all DNSBL blacklists.
AGM-001: Configure DKIM via Amazon SES + GoDaddy CNAME records (30min-1h)
AGM-002: Change SPF from ~all to -all (hardfail) (5min)
AGM-003: Add rua reporting to DMARC, then escalate to p=reject (5min)
AGM-010: Verify domain auto-renewal is enabled (2min)
| ID | Finding | Severity | Status |
|---|---|---|---|
AGM-001 | No DKIM Authentication | Critical | Open |
AGM-002 | SPF Uses Softfail Instead of Hardfail | High | Open |
AGM-003 | DMARC Not at Reject Policy and Missing Reporting | High | Open |
AGM-004 | Weak Content Security Policy | High | Open |
AGM-005 | SMTP STARTTLS Not Detected | High | Open |
AGM-006 | HSTS Max-Age Too Short, No Preload | Medium | Open |
AGM-007 | No CAA Records | Medium | Open |
AGM-008 | DNSSEC Not Enabled | Medium | Open |
AGM-009 | No MTA-STS Policy | Medium | Open |
AGM-010 | Domain Expires in 90 Days | Medium | Open |
AGM-011 | Missing Referrer-Policy Header | Low | Open |
AGM-012 | Missing Permissions-Policy Header | Low | Open |
AGM-013 | No security.txt File | Low | Open |
AGM-014 | No TLS-RPT Record and DMARC Missing Reporting | Low | Open |
AGM-015 | OG Image Uses HTTP URL | Info | Open |
AGM-016 | No DANE/TLSA Records | Info | Open |
AGM-017 | No BIMI Record | Info | Open |
Assessment Scope
What was tested, how, and what limitations apply
In Scope
- ✓ DNS records & configuration
- ✓ Email authentication (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE)
- ✓ HTTP security headers
- ✓ SSL/TLS configuration
- ✓ DNSBL / blacklist checking
- ✓ SMTP analysis
- ✓ OSINT & historical intelligence
- ✓ Compliance framework alignment
Out of Scope
- ✗ Application security testing
- ✗ Penetration testing
- ✗ Source code review
- ✗ Social engineering
- ✗ Internal network assessment
This assessment was performed using publicly available information only. No intrusive testing was conducted. Scan timestamp: 2026-02-23T02:58:33Z. Mode: Deep Scan.
Detailed Findings
17 findings identified, sorted by severity.
No DKIM Authentication
No DKIM records were found for any of 20 common selectors. Emails from @autographman.co.uk cannot be cryptographically verified as genuine, enabling trivial email forgery. This is critical for an e-commerce platform where order confirmations and shipping notifications must be trusted.
Evidence
Selectors checked: 20 (default, google, selector1, selector2, k1, dkim, s1, s2, mail, amazonses, etc.) Found: 0 MX: inbound-smtp.us-west-2.amazonaws.com (Amazon SES) SPF includes: amazonses.com Expected: Amazon SES DKIM CNAME records
Remediation
Configure DKIM via Amazon SES console: 1. Go to AWS SES Console → Verified Identities → autographman.co.uk 2. Under Authentication tab → DKIM → Generate DKIM tokens 3. Add these 3 CNAME records at GoDaddy DNS: [token1]._domainkey.autographman.co.uk CNAME [token1].dkim.amazonses.com [token2]._domainkey.autographman.co.uk CNAME [token2].dkim.amazonses.com [token3]._domainkey.autographman.co.uk CNAME [token3].dkim.amazonses.com SES provides the exact CNAME values when you enable DKIM.
SPF Uses Softfail Instead of Hardfail
The SPF record uses ~all (softfail) instead of -all (hardfail). Softfail means receivers may accept emails from unauthorised senders with only a warning, rather than rejecting them outright.
Evidence
Current SPF: v=spf1 include:amazonses.com ~all Qualifier: softfail Recommended: v=spf1 include:amazonses.com -all (hardfail)
Remediation
Update SPF record at GoDaddy DNS: v=spf1 include:amazonses.com -all Change ~all to -all. Ensure all legitimate sending sources are included before switching to hardfail. Currently only Amazon SES is included — verify Shopify doesn't send email directly (it typically uses your configured email provider).
DMARC Not at Reject Policy and Missing Reporting
DMARC is configured at p=quarantine with 100% enforcement, which is good progress, but not yet at the recommended p=reject level. More critically, no rua (aggregate reporting) address is configured, meaning you have no visibility into email authentication failures.
Evidence
Current DMARC: v=DMARC1;p=quarantine;pct=100;fo=1 Policy: quarantine Reporting (rua): NOT CONFIGURED Missing: rua=mailto:... for aggregate reports
Remediation
Update DMARC record at GoDaddy DNS in two phases: Phase 1 (immediate — add reporting): _dmarc TXT "v=DMARC1; p=quarantine; pct=100; fo=1; rua=mailto:dmarc@autographman.co.uk" Phase 2 (after DKIM is configured and reporting confirms alignment, ~2-4 weeks): _dmarc TXT "v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc@autographman.co.uk" Consider using a free DMARC reporting service like Postmark DMARC or DMARCian to parse aggregate reports.
Weak Content Security Policy
The CSP header includes useful directives (block-all-mixed-content, frame-ancestors 'none', upgrade-insecure-requests) but is missing critical directives that restrict script and resource loading: default-src, script-src, style-src, img-src, connect-src.
Evidence
Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Missing directives: default-src, script-src, style-src, img-src, connect-src Note: Shopify manages CSP at the platform level — customisation may be limited
Remediation
Shopify controls the CSP header for storefronts. Options: 1. Check Shopify's CSP configuration options in theme settings 2. Use Shopify's Content Security Policy app if available 3. The current CSP is better than many — frame-ancestors 'none' prevents clickjacking entirely 4. For full CSP control, consider a reverse proxy (Cloudflare Workers) to inject additional directives Note: Shopify's architecture makes strict CSP challenging due to third-party scripts for analytics, payment processing, and app integrations.
SMTP STARTTLS Not Detected
The SMTP connection to the MX server (Amazon SES) did not indicate STARTTLS support during the scan. Without STARTTLS, inbound email is unencrypted in transit. Note: Amazon SES normally supports STARTTLS — this is likely a scan timing issue.
Evidence
MX: inbound-smtp.us-west-2.amazonaws.com (priority 10) Banner: 220 inbound-smtp.us-west-2.amazonaws.com ESMTP Amazon SES STARTTLS: false PTR: ec2-35-161-157-106.us-west-2.compute.amazonaws.com Note: Amazon SES typically supports STARTTLS. The scan may not have received the full EHLO capabilities.
Remediation
1. Verify STARTTLS manually: openssl s_client -starttls smtp -connect inbound-smtp.us-west-2.amazonaws.com:25 2. Amazon SES always supports TLS — if confirmed working, this is a scan limitation 3. Consider adding MTA-STS to enforce TLS for inbound email
HSTS Max-Age Too Short, No Preload
HSTS is enabled but with max-age of only ~91 days (7,889,238 seconds). The recommended minimum is 1 year (31,536,000 seconds). The includeSubDomains and preload directives are also absent, preventing HSTS preload list submission.
Evidence
Strict-Transport-Security: max-age=7889238 Missing: includeSubDomains Missing: preload directive Current max-age: ~91 days Recommended: max-age=63072000 (2 years)
Remediation
This is controlled by Shopify's platform. Shopify sets HSTS for all storefronts but at a shorter max-age. Options: 1. Contact Shopify support about increasing HSTS max-age 2. Use Cloudflare's HSTS settings to override (if proxied through CF) 3. Note: Shopify's HSTS is adequate for most purposes — the shorter max-age is a minor concern
No CAA Records
No CAA (Certificate Authority Authorization) records exist. Any certificate authority can issue certificates for this domain. Given the domain uses both Let's Encrypt and Google Trust Services certificates, CAA should restrict to these issuers.
Evidence
dig CAA autographman.co.uk → No records Current CAs in use: - Let's Encrypt (E7, E8) — Shopify-managed certs - Google Trust Services (WE1, WR1) — Cloudflare-managed certs
Remediation
Add CAA records at GoDaddy DNS: autographman.co.uk. CAA 0 issue "letsencrypt.org" autographman.co.uk. CAA 0 issue "pki.goog" autographman.co.uk. CAA 0 iodef "mailto:admin@autographman.co.uk"
DNSSEC Not Enabled
DNSSEC is not configured for this domain. DNS responses can be spoofed or tampered with in transit, enabling cache poisoning and man-in-the-middle attacks.
Evidence
dig DS autographman.co.uk → No DS records DNSSEC: disabled Registrar DNS: ns69.domaincontrol.com / ns70.domaincontrol.com (GoDaddy)
Remediation
Enable DNSSEC via GoDaddy domain management: 1. Log into GoDaddy → My Products → DNS Management 2. Navigate to DNSSEC settings 3. Enable DNSSEC (GoDaddy handles key generation and DS record publication for .co.uk domains) Note: .co.uk domains fully support DNSSEC via Nominet.
No MTA-STS Policy
No MTA-STS (Mail Transfer Agent Strict Transport Security) policy exists. Without MTA-STS, there is no mechanism to enforce TLS for inbound email connections, allowing downgrade attacks.
Evidence
MTA-STS record: Not found MTA-STS mode: null MX: Amazon SES (supports TLS natively, but MTA-STS adds enforcement)
Remediation
1. Create MTA-STS policy file hosted at https://mta-sts.autographman.co.uk/.well-known/mta-sts.txt: version: STSv1 mode: enforce mx: inbound-smtp.us-west-2.amazonaws.com max_age: 604800 2. Add DNS record: _mta-sts TXT "v=STSv1; id=20260223" Note: Requires hosting the policy file on a subdomain — can use Cloudflare Pages or an S3 bucket.
Domain Expires in 90 Days
The domain autographman.co.uk expires on 2026-05-24, which is only 90 days away. For a trading e-commerce domain, this should be renewed well in advance to prevent accidental expiration and potential loss of the domain.
Evidence
Domain: autographman.co.uk Created: 2016-05-24 Expires: 2026-05-24T01:37:09Z Days to expiry: 90 Registrar: GoDaddy Auto-renew: Check GoDaddy settings
Remediation
1. Log into GoDaddy → My Products → Domain Management 2. Verify auto-renewal is enabled for autographman.co.uk 3. Consider renewing for multiple years to avoid annual renewal risk 4. Ensure the payment method on file is current
Missing Referrer-Policy Header
No Referrer-Policy header is set. The browser's default behaviour may leak the full URL (including product pages and search queries) to external sites when users click outbound links.
Evidence
Response headers scanned — Referrer-Policy: NOT PRESENT Expected: Referrer-Policy: strict-origin-when-cross-origin
Remediation
Shopify controls response headers at the platform level. This header may need to be added via: 1. Shopify theme liquid (meta tag): <meta name="referrer" content="strict-origin-when-cross-origin"> 2. Cloudflare Transform Rules to inject the header
Missing Permissions-Policy Header
No Permissions-Policy header is set. Browser features like camera, microphone, geolocation, and payment APIs are not explicitly restricted.
Evidence
Response headers scanned — Permissions-Policy: NOT PRESENT
Remediation
Add via Cloudflare Transform Rules: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(self)
No security.txt File
No security.txt file exists at /.well-known/security.txt (RFC 9116). This file provides security researchers with contact information for responsible vulnerability disclosure.
Evidence
GET https://autographman.co.uk/.well-known/security.txt → Not found
Remediation
Shopify doesn't support custom files at /.well-known/ paths. Alternatives: 1. Use Shopify's custom page feature to create /pages/security 2. Add a security contact to the site footer 3. Use Cloudflare Workers to serve security.txt at the correct path
No TLS-RPT Record and DMARC Missing Reporting
No TLS-RPT record exists and DMARC has no rua (aggregate reporting) configured. You have no visibility into either email TLS failures or email authentication failures.
Evidence
dig TXT _smtp._tls.autographman.co.uk → No record found DMARC rua: NOT CONFIGURED
Remediation
Add DNS records at GoDaddy: _smtp._tls TXT "v=TLSRPTv1; rua=mailto:tlsrpt@autographman.co.uk" And update DMARC to include rua (see AGM-003).
OG Image Uses HTTP URL
The og:image meta tag uses an HTTP URL instead of HTTPS. While og:image:secure_url is also set with HTTPS, the primary og:image tag should use HTTPS for consistency and to avoid mixed content warnings in social sharing previews.
Evidence
og:image: http://autographman.co.uk/cdn/shop/files/Autographs-social-share.jpg og:image:secure_url: https://autographman.co.uk/cdn/shop/files/Autographs-social-share.jpg
Remediation
Update the Shopify theme to use HTTPS for the primary og:image tag. In the theme's theme.liquid or relevant section: Change: <meta property="og:image" content="http://..."> To: <meta property="og:image" content="https://...">
No DANE/TLSA Records
No DANE (DNS-based Authentication of Named Entities) TLSA records exist for the MX server. DANE provides certificate verification via DNS but requires DNSSEC.
Evidence
dig TLSA _25._tcp.inbound-smtp.us-west-2.amazonaws.com → No records Prerequisite: DNSSEC must be enabled before DANE can be effective
Remediation
1. Enable DNSSEC first (see AGM-008) 2. DANE for Amazon SES is managed by AWS — this is informational only
No BIMI Record
No BIMI record exists. BIMI allows displaying the Autograph Man brand logo in supporting email clients (Gmail, Apple Mail), improving brand recognition and trust for order confirmation emails.
Evidence
dig TXT default._bimi.autographman.co.uk → No record found Prerequisite: DMARC p=reject must be configured before BIMI will function
Remediation
After DMARC is set to p=reject: 1. Create a square SVG logo in Tiny P/S format 2. Add DNS record: default._bimi TXT "v=BIMI1; l=https://autographman.co.uk/bimi/logo.svg" For maximum impact (Gmail blue checkmark), obtain a VMC from DigiCert or Entrust.
Risk Matrix
Findings plotted by likelihood and impact
Compliance & Framework Assessment
Alignment against 9 industry frameworks
| Id | Control | Status | Evidence |
|---|---|---|---|
ISM-0574 | SPF specification | partial | SPF present but uses softfail (~all) instead of hardfail (-all) |
ISM-1151 | SPF verification (hardfail) | fail | Using ~all (softfail) — should be -all |
ISM-0269 | DKIM records | fail | No DKIM selectors found (0 of 20) |
ISM-1540 | DMARC configuration | pass | DMARC present: p=quarantine, pct=100, fo=1 |
ISM-1799 | DMARC enforcement | partial | p=quarantine (not reject), no rua reporting |
ISM-0569 | Email gateway routing | pass | MX points to Amazon SES inbound SMTP |
ISM-1552 | HTTPS-only | pass | HSTS enabled, CSP upgrade-insecure-requests |
ISM-1139 | TLS configuration | pass | TLS 1.3 with AES-256 and PFS |
ISM-1369 | TLS forward secrecy | pass | PFS enabled (TLS 1.3 implies PFS) |
ISM-1706 | DNSSEC | fail | No DS records found |
ISM-1485 | Security headers | partial | 4 of 9 scored headers present (44%) |
ISM-0659 | Content filtering | partial | No CAA records; CSP present but incomplete; Cloudflare WAF active |
ISM-1157 | Gateway security | pass | Cloudflare WAF and CDN active |
| Control | Status | Evidence |
|---|---|---|
| INFOSEC-3: Email authentication | partial | SPF softfail, DKIM absent, DMARC quarantine (no reporting) |
| INFOSEC-4: Web security | partial | HSTS, TLS 1.3, Cloudflare WAF, but incomplete CSP and missing headers |
| INFOSEC-10: Essential Eight alignment | partial | 2 controls at ML3, 2 at ML1; better than average |
| Control | Status | Evidence |
|---|---|---|
| 9.2: DNS filtering/security | fail | No DNSSEC, no CAA records |
| 9.5: DMARC enforcement | partial | DMARC at quarantine, not reject |
| 3.10: TLS configuration | pass | TLS 1.3 with AES-256, PFS, Cloudflare CDN |
| 12.1: DNS infrastructure | partial | GoDaddy managed NS, no DNSSEC, no CAA, consistent propagation |
Overall CSF Score: 40% (12/30)
| Control | Status | Evidence |
|---|---|---|
| PCI DSS 4.2.1: Strong cryptography | pass | TLS 1.3 with AES-256 |
| PCI DSS 6.4.1: Public-facing web app protections | pass | Cloudflare WAF active, CSP with frame-ancestors 'none' |
| PCI DSS 11.3.1: Vulnerability management | partial | Shopify managed platform; no security.txt for disclosure |
| Control | Status | Evidence |
|---|---|---|
| Firewalls | pass | Cloudflare WAF active with CDN edge protection |
| Secure Configuration | partial | 4 of 7 key security headers present; missing Referrer-Policy, Permissions-Policy |
| Security Update Management | pass | Shopify fully managed SaaS — automatic updates |
| Access Control | Requires Internal Assessment | Cannot assess from external scan |
| Malware Protection | Requires Internal Assessment | Cannot assess from external scan |
| Control | Status | Evidence |
|---|---|---|
| A05:2021 Security Misconfiguration | partial | Good header coverage (4/9); weak CSP; missing Referrer-Policy, Permissions-Policy |
| A02:2021 Cryptographic Failures | pass | TLS 1.3, AES-256, PFS, valid certificate |
| A07:2021 Identification and Authentication Failures | fail | No DKIM — email authentication incomplete |
| Control | Status | Evidence |
|---|---|---|
| A.8.24: Use of cryptography | pass | TLS 1.3 with AES-256 and PFS |
| A.8.20: Network security | partial | HSTS and Cloudflare WAF; DNSSEC missing |
| A.5.14: Information transfer | partial | DMARC quarantine in place but DKIM missing, SPF softfail |
Email Security Deep Dive
SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE, and BIMI analysis
| Protocol | Status | Details |
|---|---|---|
| SPF | Found | v=spf1 include:amazonses.com ~allQualifier: softfail |
| DKIM | Not Found | Checked 20 selectors |
| DMARC | Found | v=DMARC1;p=quarantine;pct=100;fo=1Policy: quarantine |
| MTA-STS | Missing | No MTA-STS policy |
| TLS-RPT | Missing | No TLS-RPT record |
| DANE/TLSA | Not Found | No TLSA records |
| BIMI | Not Found | No BIMI record |
SPF Mechanism Analysis
include:amazonses.com~allDNS & Domain Infrastructure
Nameservers, records, and DNSSEC status
| Record Type | Value |
|---|---|
| NS | ns69.domaincontrol.com ns70.domaincontrol.com |
| MX | 10 inbound-smtp.us-west-2.amazonaws.com |
| A | 23.227.38.65 |
| AAAA | 2620:127:f00f:5:: |
| SOA | ns69.domaincontrol.com dns.jomax.net 2024071703 |
| CAA | |
| DNSSEC | Not Enabled |
Infrastructure Geolocation
| IP | Location | ISP / Org |
|---|---|---|
| 23.227.38.65 | Ottawa, Canada | Cloudflare, Inc. |
DNS Quality Metrics
Nameserver diversity, propagation, and configuration health
DNS Propagation Check
DNS resolution is consistent across global resolvers.
| Resolver | Results |
|---|---|
| Google 8.8.8.8 | 23.227.38.65 |
| Cloudflare 1.1.1.1 | 23.227.38.65 |
| Quad9 9.9.9.9 | 23.227.38.65 |
| OpenDNS 208.67.222.222 | 23.227.38.65 |
TTL Values
| Record Type | TTL (seconds) |
|---|---|
| A | 1799 |
| MX | 1215 |
| NS | 1215 |
HTTP Security Headers
Analysis of security-related HTTP response headers
| Header | Status | Value |
|---|---|---|
| Strict-Transport-Security | Present | max-age=7889238 |
| Content-Security-Policy | Present | block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; |
| X-Frame-Options | Present | DENY |
| X-Content-Type-Options | Present | nosniff |
| Referrer-Policy | Missing | — |
| Permissions-Policy | Missing | — |
| X-XSS-Protection | Present | 1; mode=block |
| Cross-Origin-Opener-Policy | Missing | — |
| Cross-Origin-Resource-Policy | Missing | — |
| Cross-Origin-Embedder-Policy | Missing | — |
| Cache-Control | Missing | — |
| Server | Present | cloudflare |
Cookie, CORS & Web Security
Cookie flags, CORS policy, mixed content, and CSP analysis
Cookies
| Cookie | Secure | HttpOnly | SameSite |
|---|---|---|---|
localization | Yes | Yes | Lax |
CORS Policy
Access-Control-Allow-Origin: Not set
CSP Analysis
{
"directives": [
"block-all-mixed-content",
"frame-ancestors 'none'",
"upgrade-insecure-requests"
],
"raw": "block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;",
"missingDirectives": [
"default-src",
"script-src",
"style-src",
"img-src",
"connect-src"
]
}Blacklist & Email Reputation
DNSBL and domain reputation checks
The DNS resolver is blocking DNSBL queries. Blacklist results below may be unreliable.
IP Blacklist Checks
| DNSBL | Status |
|---|---|
| zen.spamhaus.org | Clean |
| bl.spamcop.net | Clean |
| b.barracudacentral.org | Clean |
| dnsbl.sorbs.net | Clean |
| cbl.abuseat.org | Clean |
Domain Blacklist Checks
| DNSBL | Status |
|---|---|
| dbl.spamhaus.org | Clean |
| multi.uribl.com | Clean |
| multi.surbl.org | Clean |
| black.uribl.com | Clean |
SMTP Analysis
Mail server banner, capabilities, and encryption
| Check | Result |
|---|---|
| Banner | 220 inbound-smtp.us-west-2.amazonaws.com ESMTP Amazon SES Rf3xyL02r910lJBaYbGt |
| EHLO Capabilities | inbound-smtp.us-west-2.amazonaws.com |
| STARTTLS | Not Supported |
| PTR Record | ec2-52-43-162-244.us-west-2.compute.amazonaws.com |
OSINT & Historical Intelligence
Certificate transparency, archived snapshots, and subdomain enumeration
Certificate Transparency Logs
| Common Name | Issuer | Not Before |
|---|---|---|
| autographman.co.uk | C=US, O=Let's Encrypt, CN=E8 | 2026-02-09T00:32:03 |
| autographman.co.uk | C=US, O=Let's Encrypt, CN=E8 | 2026-02-09T00:32:03 |
| www.autographman.co.uk | C=US, O=Let's Encrypt, CN=E7 | 2026-02-06T17:08:02 |
| www.autographman.co.uk | C=US, O=Let's Encrypt, CN=E7 | 2026-02-06T17:08:02 |
| autographman.co.uk | C=US, O=Google Trust Services, CN=WE1 | 2026-01-27T01:12:06 |
| autographman.co.uk | C=US, O=Google Trust Services, CN=WE1 | 2026-01-27T01:12:06 |
| autographman.co.uk | C=US, O=Google Trust Services, CN=WR1 | 2026-01-27T01:11:51 |
| www.autographman.co.uk | C=US, O=Google Trust Services, CN=WE1 | 2026-01-27T00:07:26 |
| www.autographman.co.uk | C=US, O=Google Trust Services, CN=WE1 | 2026-01-27T00:07:26 |
| www.autographman.co.uk | C=US, O=Google Trust Services, CN=WR1 | 2026-01-27T00:06:33 |
| autographman.co.uk | C=US, O=Let's Encrypt, CN=E8 | 2025-12-10T19:48:33 |
| autographman.co.uk | C=US, O=Let's Encrypt, CN=E8 | 2025-12-10T19:48:33 |
| www.autographman.co.uk | C=US, O=Let's Encrypt, CN=E8 | 2025-12-09T03:19:04 |
| www.autographman.co.uk | C=US, O=Let's Encrypt, CN=E8 | 2025-12-09T03:19:04 |
| autographman.co.uk | C=US, O=Google Trust Services, CN=WE1 | 2025-11-29T00:58:51 |
| autographman.co.uk | C=US, O=Google Trust Services, CN=WE1 | 2025-11-29T00:58:51 |
| autographman.co.uk | C=US, O=Google Trust Services, CN=WR1 | 2025-11-29T00:58:35 |
| www.autographman.co.uk | C=US, O=Google Trust Services, CN=WE1 | 2025-11-28T22:11:28 |
| www.autographman.co.uk | C=US, O=Google Trust Services, CN=WE1 | 2025-11-28T22:11:28 |
| www.autographman.co.uk | C=US, O=Google Trust Services, CN=WR1 | 2025-11-28T22:11:17 |
Showing 20 of 50 certificates
Wayback Machine History
Typosquatting & Similar Domains
Common misspellings and confusable domain variants that could be used for phishing or brand impersonation. These should be monitored or defensively registered.
101 variants generated: 12 tld variant, 5 homoglyph, 11 transposed, 43 adjacent key, 12 missing letter, 12 doubled letter, 6 hyphenation
Showing 24 of 101 variants (highest-threat first)
Discovered Subdomains (3)
| Subdomain |
|---|
| *.autographman.co.uk |
| sni.cloudflaressl.com |
| www.autographman.co.uk |
Technology Stack
Detected platform, CDN, WAF, and server details
| Component | Details |
|---|---|
| Platform | Shopify |
| CDN | Cloudflare |
| WAF | Cloudflare |
| Server | cloudflare |
| TLS Version | TLS 1.3 |
| Cipher Suite | Aes256 |
| SSL Expiry | 2026-05-10 |
| Perfect Forward Secrecy | Yes |
Hosting & Infrastructure
Hosting provider, server software, CMS detection, and certificate history
| Component | Details |
|---|---|
| Hosting Provider | Cloudflare |
| ASN Organization | Shopify, Inc. |
| CMS Detected | Shopify |
Certificate Issuer History
| Issuer | Certificates | First Seen | Last Seen |
|---|---|---|---|
| 50 | 2025-09-30T20:33:51 | 2025-11-29T00:58:35 |
WHOIS & Domain Intelligence
Domain registration, expiry, registrant contacts, and TLD-specific status analysis via RDAP
Domain Profile
| Field | Value |
|---|---|
| Registrar | GODADDY |
| TLD | .co.uk |
| Registered | 2016-05-24 (9y 9m ago) |
| Expires | 2026-05-24 (90 days remaining) |
| Registrant Privacy | No (public registration) |
| RDAP Source | https://rdap.org/domain/autographman.co.uk |
Contact Information
| Role | Name | Organisation | Country | |
|---|---|---|---|---|
| Registrant | — | — | — | redacted@nominet.uk |
Domain Status Codes
| Status Code | Interpretation | Severity |
|---|---|---|
client transfer prohibited | Nominet registrar lock (standard .uk default) | info |
client delete prohibited | Registrar-set delete protection | info |
client update prohibited | Registrar-set update lock | info |
client renew prohibited | Registrar-set renewal lock | warning |
Governed by Nominet UK. UK-based dispute resolution via DRS (Dispute Resolution Service).
clientTransferProhibited and serverTransferProhibited are standard Nominet defaults.RDAP Nameservers
ns70.domaincontrol.com.
SEO & Visibility
Meta tags, Open Graph, structured data, and sitemap analysis
| Check | Status | Details |
|---|---|---|
| Title Tag | Found | Autograph Man - The World's Autograph Marketplace – autographman (74 chars - over recommended 60) |
| Meta Description | Found | All things Autographs. The World's leading market place for autographs of celebrity and people o... (112 chars) |
| Canonical URL | Found | https://autographman.co.uk/ |
| Viewport Meta | Found | Present |
| JSON-LD Structured Data | Found | Present |
| Twitter Card | Found | summary_large_image |
| Sitemap | Found | Accessible (4 URLs) |
Open Graph Tags
| Property | Value |
|---|---|
og:image | http://autographman.co.uk/cdn/shop/files/Autographs-social-share.jpg?v=1713147126 |
og:image:height | 600 |
og:image:secure_url | https://autographman.co.uk/cdn/shop/files/Autographs-social-share.jpg?v=1713147126 |
og:url | https://autographman.co.uk/ |
og:title | Autograph Man - The World's Autograph Marketplace |
og:image:width | 1200 |
og:description | All things Autographs. The World's leading market place for autographs of celebrity and people of notoriety. |
og:type | website |
og:site_name | autographman |
Social Share Previews
How this site appears when shared on social platforms.


robots.txt Directives (162)
User-agent: * Disallow: /a/downloads/-/* Disallow: /admin Disallow: /cart Disallow: /orders Disallow: /checkouts/ Disallow: /checkout Disallow: /59201421390/checkouts Disallow: /59201421390/orders Disallow: /carts Disallow: /account Disallow: /collections/*sort_by* Disallow: /*/collections/*sort_by* Disallow: /collections/*+* Disallow: /collections/*%2B* Disallow: /collections/*%2b* Disallow: /*/collections/*+* Disallow: /*/collections/*%2B* Disallow: /*/collections/*%2b* Disallow: */collections/*filter*&*filter* Disallow: /blogs/*+* Disallow: /blogs/*%2B* Disallow: /blogs/*%2b* Disallow: /*/blogs/*+* Disallow: /*/blogs/*%2B* Disallow: /*/blogs/*%2b* Disallow: /*?*oseid=* Disallow: /*preview_theme_id* Disallow: /*preview_script_id* Disallow: /policies/ Disallow: /*/policies/ Disallow: /*/*?*ls=*&ls=* Disallow: /*/*?*ls%3D*%3Fls%3D* Disallow: /*/*?*ls%3d*%3fls%3d* Disallow: /search Disallow: /sf_private_access_tokens Disallow: /apple-app-site-association Disallow: /.well-known/shopify/monorail Disallow: /cdn/wpm/*.js Disallow: /recommendations/products Disallow: /*/recommendations/products Disallow: /products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Sitemap: https://autographman.co.uk/sitemap.xml User-agent: adsbot-google Disallow: /checkouts/ Disallow: /checkout Disallow: /carts Disallow: /orders Disallow: /59201421390/checkouts Disallow: /59201421390/orders Disallow: /*?*oseid=* Disallow: /*preview_theme_id* Disallow: /*preview_script_id* Disallow: /cdn/wpm/*.js Disallow: /products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /sf_private_access_tokens User-agent: Nutch Disallow: / User-agent: AhrefsBot Crawl-delay: 10 Disallow: /a/downloads/-/* Disallow: /admin Disallow: /cart Disallow: /orders Disallow: /checkouts/ Disallow: /checkout Disallow: /59201421390/checkouts Disallow: /59201421390/orders Disallow: /carts Disallow: /account Disallow: /collections/*sort_by* Disallow: /*/collections/*sort_by* Disallow: /collections/*+* Disallow: /collections/*%2B* Disallow: /collections/*%2b* Disallow: /*/collections/*+* Disallow: /*/collections/*%2B* Disallow: /*/collections/*%2b* Disallow: */collections/*filter*&*filter* Disallow: /blogs/*+* Disallow: /blogs/*%2B* Disallow: /blogs/*%2b* Disallow: /*/blogs/*+* Disallow: /*/blogs/*%2B* Disallow: /*/blogs/*%2b* Disallow: /*?*oseid=* Disallow: /*preview_theme_id* Disallow: /*preview_script_id* Disallow: /policies/ Disallow: /*/policies/ Disallow: /*/*?*ls=*&ls=* Disallow: /*/*?*ls%3D*%3Fls%3D* Disallow: /*/*?*ls%3d*%3fls%3d* Disallow: /search Disallow: /sf_private_access_tokens Disallow: /apple-app-site-association Disallow: /.well-known/shopify/monorail Disallow: /cdn/wpm/*.js Disallow: /recommendations/products Disallow: /*/recommendations/products Disallow: /products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Sitemap: https://autographman.co.uk/sitemap.xml User-agent: AhrefsSiteAudit Crawl-delay: 10 Disallow: /a/downloads/-/* Disallow: /admin Disallow: /cart Disallow: /orders Disallow: /checkouts/ Disallow: /checkout Disallow: /59201421390/checkouts Disallow: /59201421390/orders Disallow: /carts Disallow: /account Disallow: /collections/*sort_by* Disallow: /*/collections/*sort_by* Disallow: /collections/*+* Disallow: /collections/*%2B* Disallow: /collections/*%2b* Disallow: /*/collections/*+* Disallow: /*/collections/*%2B* Disallow: /*/collections/*%2b* Disallow: */collections/*filter*&*filter* Disallow: /blogs/*+* Disallow: /blogs/*%2B* Disallow: /blogs/*%2b* Disallow: /*/blogs/*+* Disallow: /*/blogs/*%2B* Disallow: /*/blogs/*%2b* Disallow: /*?*oseid=* Disallow: /*preview_theme_id* Disallow: /*preview_script_id* Disallow: /policies/ Disallow: /*/policies/ Disallow: /*/*?*ls=*&ls=* Disallow: /*/*?*ls%3D*%3Fls%3D* Disallow: /*/*?*ls%3d*%3fls%3d* Disallow: /search Disallow: /sf_private_access_tokens Disallow: /apple-app-site-association Disallow: /.well-known/shopify/monorail Disallow: /cdn/wpm/*.js Disallow: /recommendations/products Disallow: /*/recommendations/products Disallow: /products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Sitemap: https://autographman.co.uk/sitemap.xml User-agent: MJ12bot Crawl-delay: 10 User-agent: Pinterest Crawl-delay: 1
⚠ Sensitive Paths Disclosed in robots.txt
These paths are publicly visible in robots.txt, revealing internal application structure to attackers.
/admin/admin/admin
Site Structure & Crawl Analysis
Pages discovered via HTTP crawl compared against sitemap.xml
Site Map Diagram
Broken Links (1)
| URL | Status | Linked From |
|---|---|---|
https://autographman.co.uk/customer_authentication/redirect?locale=en®ion_country=AU | 403 | https://autographman.co.uk/ |
Discovered But Not in Sitemap (14)
These pages were found by crawling but are missing from sitemap.xml. Consider adding them for better SEO indexing.
In Sitemap But Not Crawled (1410)
These URLs are listed in sitemap.xml but were not reachable within the crawl depth limit (2 levels). They may be orphaned pages or require deeper navigation paths.
Proactive Monitoring Recommendations
Recommended monitoring and alerting setup
| Monitor | Tool | Frequency |
|---|---|---|
| DNSBL monitoring | HetrixTools free tier | Every 6 hours |
| DMARC aggregate reports | Postmark DMARC / DMARCian free | Weekly review |
| SSL certificate expiry | Uptime Kuma / UptimeRobot | Daily |
| Domain expiry alerting | GoDaddy auto-renew + external monitor | Monthly check |
| CT log monitoring | CertSpotter / Facebook CT Monitor | Real-time |
Recommendations & Remediation Roadmap
Prioritized actions grouped by timeline
Immediate (0-48 hours)
| Finding | Severity | Action | Effort |
|---|---|---|---|
AGM-001 | Critical | Configure DKIM via Amazon SES + GoDaddy CNAME records | 30min-1h |
AGM-002 | High | Change SPF from ~all to -all (hardfail) | 5min |
AGM-003 | High | Add rua reporting to DMARC, then escalate to p=reject | 5min |
AGM-010 | Medium | Verify domain auto-renewal is enabled | 2min |
Short Term (1-2 weeks)
| Finding | Severity | Action | Effort |
|---|---|---|---|
AGM-007 | Medium | Add CAA records for Let's Encrypt + Google Trust Services | 5min |
AGM-008 | Medium | Enable DNSSEC via GoDaddy | 5min |
AGM-015 | Info | Fix og:image to use HTTPS in Shopify theme | 10min |
AGM-003 | High | Escalate DMARC to p=reject after 2-4 weeks monitoring | 5min |
Medium Term (1-3 months)
| Finding | Severity | Action | Effort |
|---|---|---|---|
AGM-004 | High | Investigate CSP improvements via Cloudflare Transform Rules | 1-2h |
AGM-009 | Medium | Configure MTA-STS (host policy via Cloudflare Pages or S3) | 1-2h |
AGM-011 | Low | Add Referrer-Policy via Cloudflare Transform Rules or theme meta tag | 15min |
AGM-017 | Info | Set up BIMI after DMARC p=reject is in place | 1-2h |
Appendices
Raw data, glossary, and disclaimers
A. robots.txt
# we use Shopify as our ecommerce platform # ââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€â€œ # Ã¢â€Æ’ Robots & Agent policy Ã¢â€Æ’ # ââ€Â£Ã¢â€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Â« # Ã¢â€Æ’ Checkouts are for humans. Ã¢â€Æ’ # Ã¢â€Æ’ * Automated scraping, “buy-for-me†agents, or any end-to-end flow Ã¢â€Æ’ # Ã¢â€Æ’ that completes payment without a final human review step is not Ã¢â€Æ’ # Ã¢â€Æ’ permitted. Ã¢â€Æ’ # Ã¢â€Æ’ * Legitimate integrators must use the official Checkout Kit: Ã¢â€Æ’ # Ã¢â€Æ’ https://www.shopify.com/checkout-kit Ã¢â€Æ’ # Ã¢â€Æ’ Ã¢â€Æ’ # Ã¢â€Æ’ Terms of Service: https://www.shopify.com/legal/terms Ã¢â€Æ’ # Ã¢â€Æ’ Contact: bots@shopify.com Ã¢â€Æ’ # ââ€â€”ââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€Âââ€â€º User-agent: * Disallow: /a/downloads/-/* Disallow: /admin Disallow: /cart Disallow: /orders Disallow: /checkouts/ Disallow: /checkout Disallow: /59201421390/checkouts Disallow: /59201421390/orders Disallow: /carts Disallow: /account Disallow: /collections/*sort_by* Disallow: /*/collections/*sort_by* Disallow: /collections/*+* Disallow: /collections/*%2B* Disallow: /collections/*%2b* Disallow: /*/collections/*+* Disallow: /*/collections/*%2B* Disallow: /*/collections/*%2b* Disallow: */collections/*filter*&*filter* Disallow: /blogs/*+* Disallow: /blogs/*%2B* Disallow: /blogs/*%2b* Disallow: /*/blogs/*+* Disallow: /*/blogs/*%2B* Disallow: /*/blogs/*%2b* Disallow: /*?*oseid=* Disallow: /*preview_theme_id* Disallow: /*preview_script_id* Disallow: /policies/ Disallow: /*/policies/ Disallow: /*/*?*ls=*&ls=* Disallow: /*/*?*ls%3D*%3Fls%3D* Disallow: /*/*?*ls%3d*%3fls%3d* Disallow: /search Disallow: /sf_private_access_tokens Disallow: /apple-app-site-association Disallow: /.well-known/shopify/monorail Disallow: /cdn/wpm/*.js Disallow: /recommendations/products Disallow: /*/recommendations/products Disallow: /products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Sitemap: https://autographman.co.uk/sitemap.xml # Google adsbot ignores robots.txt unless specifically named! User-agent: adsbot-google Disallow: /checkouts/ Disallow: /checkout Disallow: /carts Disallow: /orders Disallow: /59201421390/checkouts Disallow: /59201421390/orders Disallow: /*?*oseid=* Disallow: /*preview_theme_id* Disallow: /*preview_script_id* Disallow: /cdn/wpm/*.js Disallow: /products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /sf_private_access_tokens User-agent: Nutch Disallow: / User-agent: AhrefsBot Crawl-delay: 10 Disallow: /a/downloads/-/* Disallow: /admin Disallow: /cart Disallow: /orders Disallow: /checkouts/ Disallow: /checkout Disallow: /59201421390/checkouts Disallow: /59201421390/orders Disallow: /carts Disallow: /account Disallow: /collections/*sort_by* Disallow: /*/collections/*sort_by* Disallow: /collections/*+* Disallow: /collections/*%2B* Disallow: /collections/*%2b* Disallow: /*/collections/*+* Disallow: /*/collections/*%2B* Disallow: /*/collections/*%2b* Disallow: */collections/*filter*&*filter* Disallow: /blogs/*+* Disallow: /blogs/*%2B* Disallow: /blogs/*%2b* Disallow: /*/blogs/*+* Disallow: /*/blogs/*%2B* Disallow: /*/blogs/*%2b* Disallow: /*?*oseid=* Disallow: /*preview_theme_id* Disallow: /*preview_script_id* Disallow: /policies/ Disallow: /*/policies/ Disallow: /*/*?*ls=*&ls=* Disallow: /*/*?*ls%3D*%3Fls%3D* Disallow: /*/*?*ls%3d*%3fls%3d* Disallow: /search Disallow: /sf_private_access_tokens Disallow: /apple-app-site-association Disallow: /.well-known/shopify/monorail Disallow: /cdn/wpm/*.js Disallow: /recommendations/products Disallow: /*/recommendations/products Disallow: /products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Sitemap: https://autographman.co.uk/sitemap.xml User-agent: AhrefsSiteAudit Crawl-delay: 10 Disallow: /a/downloads/-/* Disallow: /admin Disallow: /cart Disallow: /orders Disallow: /checkouts/ Disallow: /checkout Disallow: /59201421390/checkouts Disallow: /59201421390/orders Disallow: /carts Disallow: /account Disallow: /collections/*sort_by* Disallow: /*/collections/*sort_by* Disallow: /collections/*+* Disallow: /collections/*%2B* Disallow: /collections/*%2b* Disallow: /*/collections/*+* Disallow: /*/collections/*%2B* Disallow: /*/collections/*%2b* Disallow: */collections/*filter*&*filter* Disallow: /blogs/*+* Disallow: /blogs/*%2B* Disallow: /blogs/*%2b* Disallow: /*/blogs/*+* Disallow: /*/blogs/*%2B* Disallow: /*/blogs/*%2b* Disallow: /*?*oseid=* Disallow: /*preview_theme_id* Disallow: /*preview_script_id* Disallow: /policies/ Disallow: /*/policies/ Disallow: /*/*?*ls=*&ls=* Disallow: /*/*?*ls%3D*%3Fls%3D* Disallow: /*/*?*ls%3d*%3fls%3d* Disallow: /search Disallow: /sf_private_access_tokens Disallow: /apple-app-site-association Disallow: /.well-known/shopify/monorail Disallow: /cdn/wpm/*.js Disallow: /recommendations/products Disallow: /*/recommendations/products Disallow: /products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Disallow: /*/collections/*/products/*-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-remote Sitemap: https://autographman.co.uk/sitemap.xml User-agent: MJ12bot Crawl-delay: 10 User-agent: Pinterest Crawl-delay: 1
B. Sitemap
https://autographman.co.uk/sitemap.xml
C. Glossary
| Term | Definition |
|---|---|
| SPF | Sender Policy Framework — restricts which servers can send email for a domain |
| DKIM | DomainKeys Identified Mail — cryptographic email authentication |
| DMARC | Domain-based Message Authentication, Reporting & Conformance |
| MTA-STS | Mail Transfer Agent Strict Transport Security — enforces TLS for email |
| TLS-RPT | TLS Reporting — receive reports about email TLS failures |
| DANE/TLSA | DNS-based Authentication of Named Entities — binds certificates to DNS |
| DNSSEC | Domain Name System Security Extensions — cryptographic DNS validation |
| CAA | Certificate Authority Authorization — restricts which CAs can issue certificates |
| BIMI | Brand Indicators for Message Identification — brand logo in email clients |
| HSTS | HTTP Strict Transport Security — forces HTTPS connections |
| CSP | Content Security Policy — controls which resources a page can load |
| DNSBL | DNS-based Blackhole List — real-time email/IP reputation service |
D. Disclaimer
This security assessment was performed using publicly available information only. No intrusive testing, penetration testing, or vulnerability exploitation was conducted.
Severity ratings use a qualitative likelihood x impact risk matrix aligned with ISO 27005. Risk scores are indicative and based on professional judgement.
This document is classified CONFIDENTIAL and is intended solely for the named recipient.
Assessment methodology references: NIST SP 800-177 Rev. 1, OWASP Secure Headers Project, PCI DSS v4.0, UK Cyber Essentials, ACSC Essential Eight, ISO 27005.