pixellsprint.netlify.app

Results Summary

22 findings detected across pixellsprint.netlify.app.

Severity Breakdown

Total findings detected across all components. The public summary below groups findings by vulnerability type. To see every affected component in full detail, run a free scan on your own domain at vulnify.app/tools.

Findings Overview

22 unique issues shown below, grouped from 22 total findings. When a vulnerability affects multiple components, it is listed once with the affected component count.

• high Multiple high-value Joomla public surfaces responded during validation

  Observed 4 high-value Joomla surfaces responding across API, administrator, installation, and manifest endpoints. That creates a much richer reconnaissance picture than a homepage-only scan would show.

• high Content-Security-Policy header missing

  No CSP header detected. XSS impact surface is larger.

• medium Joomla footprint signals are weak or missing

  Joomla signal count: 0. Confirm the target is a live Joomla frontend URL.

• medium Content-Security-Policy (CSP): missing

  Prevents XSS and data injection attacks

• medium X-Frame-Options: missing

  Prevents clickjacking attacks

• medium X-XSS-Protection: missing

  Legacy XSS protection (modern browsers use CSP)

• medium Referrer-Policy: missing

  Controls how much referrer information is shared

• medium Permissions-Policy: missing

  Controls browser features and APIs

• medium [REDACTED]: missing

  Restricts Adobe Flash and PDF policies

• medium Disclosure headers or generator metadata expose stack details

  Server: Netlify

• low Limited Joomla component visibility from the public surface

  No strong Joomla component or template slugs were extracted from the initial public response. This can happen when assets are rewritten or optimized.

• low Public Joomla API surface responded during validation

  Observed /api/index.php/v1 responding with status 404. Review whether this public API exposure is intentional and aligned with your access design.

• low Joomla administrator entry point is publicly reachable

  Observed /administrator/ responding with status 307. Public reachability is common, but high-value admin paths should still be protected by stronger controls and monitoring.

• info Broader Joomla route coverage completed

  Sampled 6 frontend route(s) plus bounded public Joomla surfaces for deeper evidence.

• info TLS grade: A+

  Protocol: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 (TLSv1.3)

• info Strict-Transport-Security (HSTS): present

  max-age=31536000; includeSubDomains; preload

• info X-Content-Type-Options: present

  nosniff

• info No Set-Cookie headers observed

  No cookies were set on this response.

• info No CORS header observed on preflight

  This may be expected for same-origin-only apps.

• info Redirect chain length is healthy

  1 hop(s)

What the Joomla Stack Check Covers

This security profile for pixellsprint.netlify.app was generated by Vulnify. The check analyzes:

• Joomla core version and vulnerability lookup
• Extension inventory and security assessment
• Template and component identification
• Security headers and configuration checks
• Exposed configuration and sensitive file checks

Prioritized Actions

• highAdd Content-Security-Policy (CSP) header
• highAdd baseline CSP
• highHarden cookies
• mediumValidate Joomla target surface
• mediumReview Joomla API exposure and access design
• mediumAdd X-Frame-Options header
• mediumAdd Referrer-Policy header
• mediumAdd Permissions-Policy header
• mediumUse hardened cookie prefixes where possible
• mediumReduce disclosure headers

About This Check

This report was generated using Vulnify's free security tools. Results reflect the configuration at the time of the check. For ongoing monitoring, detailed remediation guidance, and vulnerability scanning across 50+ security tests, create a free Vulnify account.

Last checked: August 10, 2026