Domain & Email
Security Assessment

HTTP redirect chain test:
  Hop 1: http://cscc.com.au → No redirect (status: null)
  httpsEnforced: false
  hasSslStripping: false

The site responds to HTTPS when explicitly requested but does not force the upgrade from HTTP.

Add an HTTP→HTTPS redirect in the nginx configuration:

server {
    listen 80;
    server_name cscc.com.au www.cscc.com.au;
    return 301 https://$host$request_uri;
}

If using Plesk, enable 'Permanent SEO-safe 301 redirect from HTTP to HTTPS' in the domain's SSL/TLS settings.

SPF Record:
v=spf1 a mx +ip4:103.11.147.216 ip4:122.99.92.170 ip4:103.79.108.181 ip4:20.28.44.31 ip4:35.189.61.203 ip4:52.186.121.110 include:venues.cscc.com.au include:_spf.salesforce.com include:spf.protection.outlook.com include:sendgrid.net include:spf.mandrillapp.com ~all

Qualifier: softfail
Mechanisms: 6 IP4 addresses, 5 includes

Note: +ip4:103.11.147.216 uses an explicit pass (+) qualifier which is redundant but harmless.

Change the SPF qualifier from ~all to -all:

v=spf1 a mx ip4:103.11.147.216 ip4:122.99.92.170 ip4:103.79.108.181 ip4:20.28.44.31 ip4:35.189.61.203 ip4:52.186.121.110 include:venues.cscc.com.au include:_spf.salesforce.com include:spf.protection.outlook.com include:sendgrid.net include:spf.mandrillapp.com -all

Also remove the redundant + prefix from ip4:103.11.147.216 and consider whether all 6 IP addresses and 5 includes are still actively sending mail — unused mechanisms expand the trusted sender scope unnecessarily.

Update the TXT record at cscc.com.au via DigiCert DNS (or your DNS provider).

DMARC Record:
v=DMARC1;p=quarantine;sp=none;adkim=r;aspf=r;pct=100;fo=1;rf=afrf;ri=86400;rua=mailto:netabuse@cscc.com.au;ruf=mailto:netabuse@cscc.com.au

Policy: quarantine
Subdomain policy: none
Alignment: relaxed (adkim=r, aspf=r)
Reporting: aggregate + forensic to netabuse@cscc.com.au

Upgrade the DMARC policy to reject after confirming legitimate senders are properly authenticated:

v=DMARC1;p=reject;sp=reject;adkim=r;aspf=r;pct=100;fo=1;rf=afrf;ri=86400;rua=mailto:netabuse@cscc.com.au;ruf=mailto:netabuse@cscc.com.au

Steps:
1. Monitor DMARC aggregate reports for 2-4 weeks at p=quarantine
2. Verify all legitimate senders pass SPF and/or DKIM alignment
3. Change p=quarantine to p=reject
4. Change sp=none to sp=reject (see CSC-004)

Update the TXT record at _dmarc.cscc.com.au via DigiCert DNS.

DMARC Record:
sp=none

Subdomains visible in Certificate Transparency:
*.cscc.com.au, intranet.cscc.com.au, shop.cscc.com.au, starrewards.cscc.com.au, bcprod.cscc.com.au, bctest.cscc.com.au, csccapi.cscc.com.au, dev.cscc.com.au, order.cscc.com.au, payments.cscc.com.au, taskportal.cscc.com.au, tasktestportal.cscc.com.au, mobileapi.cscc.com.au, webdisk.cscc.com.au

Any of these subdomain addresses can be spoofed without DMARC enforcement.

Change sp=none to sp=reject in the DMARC record:

sp=reject

If subdomains legitimately send email, ensure they have their own SPF and DKIM records. If they don't send email, sp=reject will prevent spoofing without affecting legitimate traffic.

Update the TXT record at _dmarc.cscc.com.au.

Response Headers (https://cscc.com.au):
  strict-transport-security: NOT PRESENT

HSTS Details:
  exists: false
  maxAge: 0
  includeSubDomains: false
  preload: false

HSTS Preload List: Not enrolled

Add the HSTS header in nginx configuration:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

If using Plesk, add this via Apache & nginx Settings → Additional nginx directives.

After confirming HSTS works correctly for at least 6 months, submit for HSTS preload at https://hstspreload.org/

Response Headers (https://cscc.com.au):
  content-security-policy: NOT PRESENT

CSP Analysis:
  directives: []
  raw: null

Detected technologies that would benefit from CSP:
  CMS: WordPress
  API: x-tec-api-version: v1 (The Events Calendar)
  Cache: x-litespeed-tag: b96_HTTP.200

Implement a Content Security Policy. Start with report-only mode to identify violations:

add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data: https:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" always;

Monitor the browser console for violations, refine the policy, then switch to enforcing mode:

add_header Content-Security-Policy "..." always;

WordPress may require 'unsafe-inline' and 'unsafe-eval' for script-src initially — work toward nonce-based CSP over time.

Response Header:
  x-powered-by: PHP/8.1.34,PleskLin

PHP 8.1 EOL Timeline:
  Active support ended: 25 November 2023
  Security support ended: 31 December 2025
  Current status: UNSUPPORTED (64+ days past EOL)

Additional disclosure:
  server: nginx (no version number — good)
  x-tec-api-version: v1 (The Events Calendar plugin)
  x-litespeed-tag: b96_HTTP.200 (LiteSpeed Cache plugin)

1. IMMEDIATE: Remove the X-Powered-By header:
   In php.ini: expose_php = Off
   Or in nginx: fastcgi_hide_header X-Powered-By;
   Or in Plesk: PHP Settings → expose_php = Off

2. URGENT: Upgrade PHP to a supported version:
   PHP 8.2 (security support until Dec 2026)
   PHP 8.3 (security support until Dec 2027) — recommended
   PHP 8.4 (security support until Dec 2028) — latest
   
   Test WordPress and plugins compatibility before upgrading.
   In Plesk: Websites & Domains → PHP Settings → PHP version.

3. Also hide: x-tec-api-version, x-tec-api-origin, x-tec-api-root, x-litespeed-tag headers:
   fastcgi_hide_header X-Tec-Api-Version;
   fastcgi_hide_header X-Tec-Api-Origin;
   fastcgi_hide_header X-Tec-Api-Root;
   fastcgi_hide_header X-Litespeed-Tag;

MX Record:
  cscc-com-au.mail.protection.outlook.com (priority 0)

SMTP Banner:
  220 ML1PEPF0000F179.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready

EHLO Response (incomplete):
  ML1PEPF0000F179.mail.protection.outlook.com Hello [[scanner-ip]]

STARTTLS: Not detected in scan
REQUIRETLS: Not advertised
PTR: mail-meupr01cu00200.inbound.protection.outlook.com ✓

Note: Microsoft 365 EOP supports STARTTLS by default. The scan may not have captured the full EHLO capabilities. Manual verification recommended.

1. Manually verify STARTTLS support:
   openssl s_client -connect cscc-com-au.mail.protection.outlook.com:25 -starttls smtp

   Or: Test-NetConnection cscc-com-au.mail.protection.outlook.com -Port 25

2. If STARTTLS is confirmed working (expected for M365), this finding can be downgraded to informational.

3. Implement MTA-STS (see CSC-011) to enforce TLS for inbound email — this provides a stronger guarantee than opportunistic STARTTLS.

4. Configure REQUIRETLS if supported by your mail provider to mandate TLS for outbound email.

Response Headers (https://cscc.com.au):
  x-frame-options: NOT PRESENT

Security Header Score: 0/9 (F)

Add the X-Frame-Options header in nginx configuration:

add_header X-Frame-Options "SAMEORIGIN" always;

Or via Plesk: Apache & nginx Settings → Additional nginx directives.

Note: CSP frame-ancestors directive (CSC-006) provides equivalent protection in modern browsers.

Response Headers (https://cscc.com.au):
  x-content-type-options: NOT PRESENT

Security Header Score: 0/9 (F)

Add the header in nginx configuration:

add_header X-Content-Type-Options "nosniff" always;

This is a one-line change with no compatibility risk — it should always be enabled.

DNS TXT _mta-sts.cscc.com.au: No record found
MTA-STS mode: null

MX: cscc-com-au.mail.protection.outlook.com (Microsoft 365)
STARTTLS: Not verified (see CSC-008)

1. Create a DNS TXT record:
   _mta-sts.cscc.com.au TXT "v=STSv1; id=20260305"

2. Host a policy file at https://mta-sts.cscc.com.au/.well-known/mta-sts.txt:
   version: STSv1
   mode: testing
   mx: cscc-com-au.mail.protection.outlook.com
   max_age: 86400

3. Monitor for 2-4 weeks in testing mode, then change to mode: enforce

4. Increment the id value each time the policy changes.

DNSSEC: Disabled

Nameservers: DigiCert DNS (ns10-15.digicertdns.com/net)
Note: DigiCert DNS supports DNSSEC signing.

Enable DNSSEC through your DNS provider (DigiCert DNS):

1. Contact DigiCert DNS support or access the DNS management portal
2. Enable DNSSEC signing for cscc.com.au
3. Add the DS record to the .com.au registry via your domain registrar
4. Verify with: dig cscc.com.au +dnssec

For .com.au domains, DS record submission goes through the registrar (registrar ID: 802255).

CAA Records: None found

Current certificate issuers from CT logs:
  - Let's Encrypt (cscc.com.au, starrewards.cscc.com.au, intranet.cscc.com.au)
  - Starfield Technologies (*.cscc.com.au wildcard)
  - Google Trust Services (starrewards.cscc.com.au, shop.cscc.com.au)

Multiple CA usage suggests different teams/services managing subdomains independently.

Add CAA records to restrict certificate issuance to known CAs:

cscc.com.au. CAA 0 issue "letsencrypt.org"
cscc.com.au. CAA 0 issue "starfieldtech.com"
cscc.com.au. CAA 0 issue "pki.goog"
cscc.com.au. CAA 0 issuewild "starfieldtech.com"
cscc.com.au. CAA 0 iodef "mailto:netabuse@cscc.com.au"

Add via DigiCert DNS management portal.

Response Headers (https://cscc.com.au):
  referrer-policy: NOT PRESENT

Security Header Score: 0/9 (F)

Add the header in nginx configuration:

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

This provides a good balance between privacy and functionality — same-origin requests get full referrer, cross-origin requests only get the origin.

Response Headers (https://cscc.com.au):
  permissions-policy: NOT PRESENT

Security Header Score: 0/9 (F)

Add the header in nginx configuration:

add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

This disables sensitive features that a club website is unlikely to need. Adjust if specific features are required.

DNS TXT _smtp._tls.cscc.com.au: No record found

Add a DNS TXT record:

_smtp._tls.cscc.com.au TXT "v=TLSRPTv1; rua=mailto:netabuse@cscc.com.au"

This reuses the existing abuse reporting address. Consider a dedicated address or a third-party TLS-RPT processing service.

security.txt: Not found

Checked: https://cscc.com.au/.well-known/security.txt

Create a file at /.well-known/security.txt:

Contact: mailto:netabuse@cscc.com.au
Expires: 2027-03-05T00:00:00.000Z
Preferred-Languages: en
Canonical: https://www.cscc.com.au/.well-known/security.txt

Host in WordPress: add the file to the site root, or use a plugin like WP Security.txt.

DANE/TLSA records: None found
DNSSEC: Not enabled (prerequisite for DANE)

DANE requires DNSSEC to be enabled first (see CSC-012). After enabling DNSSEC, consider adding TLSA records for the MX server. This is a low priority given current industry adoption rates.

DNS TXT default._bimi.cscc.com.au: No record found
DMARC policy: quarantine (must be reject for BIMI)

Prerequisite chain: DMARC p=reject → VMC certificate → BIMI record

After upgrading DMARC to p=reject (CSC-003):

1. Obtain a Verified Mark Certificate (VMC) from DigiCert or Entrust
2. Host the SVG logo at a public URL
3. Add DNS record: default._bimi.cscc.com.au TXT "v=BIMI1; l=https://www.cscc.com.au/logo.svg; a=https://www.cscc.com.au/vmc.pem"

Subdomains found in CT logs (21):
  Production: cscc.com.au, www.cscc.com.au, shop.cscc.com.au, starrewards.cscc.com.au, order.cscc.com.au, payments.cscc.com.au
  Internal: intranet.cscc.com.au, www.intranet.cscc.com.au
  API: csccapi.cscc.com.au, mobileapi.cscc.com.au
  Test/Dev: bctest.cscc.com.au, dev.cscc.com.au, cscctesttolo.cscc.com.au, tasktestportal.cscc.com.au
  Production support: bcprod.cscc.com.au, taskportal.cscc.com.au
  Legacy/Other: cscc-krypton-ex.cscc.com.au, webdisk.cscc.com.au
  Misconfigured: snapperandco.com.au.cscc.com.au (looks like CNAME misconfiguration)
  External: snapperandco.com.au
  Wildcard: *.cscc.com.au, *.intranet.cscc.com.au

Test/dev subdomains suggest staging environments that should be access-restricted.

1. Audit all subdomains — decommission any that are no longer needed
2. Restrict test/dev subdomains behind VPN or IP allowlist
3. Investigate snapperandco.com.au.cscc.com.au — appears to be a misconfigured CNAME
4. Consider using private CAs for internal/test certificates to avoid CT log exposure
5. Ensure DMARC sp=reject (CSC-004) to prevent subdomain email spoofing

AAAA records: None
A record: 35.189.61.203 (Google Cloud, Sydney)

Google Cloud supports IPv6 — enabling it would require a load balancer configuration change.

Consider enabling IPv6 on the Google Cloud infrastructure. This is low priority unless required by specific compliance or accessibility mandates.

Canary check: blocked

IP blacklist checks (5 providers): All clear
  zen.spamhaus.org: Not listed
  bl.spamcop.net: Not listed
  b.barracudacentral.org: Not listed
  dnsbl.sorbs.net: Not listed
  cbl.abuseat.org: Not listed

Domain blacklist checks (4 providers): All clear
  dbl.spamhaus.org: Not listed
  multi.uribl.com: Not listed
  multi.surbl.org: Not listed
  black.uribl.com: Not listed

Note: Results may be false negatives due to canary failure.

Independently verify blacklist status using:
  - https://mxtoolbox.com/blacklists.aspx
  - https://www.dnsbl.info/
  - https://hetrixtools.com/blacklist-check/

Set up ongoing monitoring with HetrixTools or UptimeRobot for proactive blacklist alerting.