Is besowb.com HIPAA secured?

Based on our automated scan, besowb.com has security issues that need to be addressed — 10 check(s) failed.

What does a HIPAA security scan check for?

Our HIPAA security scan checks for SSL/TLS encryption, security headers (HSTS, X-Frame-Options, etc.), third-party tracking scripts that may expose patient data, presence of a Privacy Policy and Notice of Privacy Practices, cookie security, email authentication (SPF, DMARC, DKIM), mixed content, health form field exposure, and more.

How do I fix HIPAA security issues on my website?

Common fixes include installing an SSL certificate, adding security headers via your web server configuration, removing non-compliant tracking scripts, publishing a HIPAA-compliant Privacy Policy and Notice of Privacy Practices, and ensuring contact forms use HIPAA-compliant services. View the full recommendations in this report or contact a HIPAA specialist for hands-on remediation.

HIPAA Security Scan: besowb.com - HIGH PRIORITY

SSL / TLS

Security Headers

Transport Security

Cookie Security

Tracking Scripts

Contact Emails

Health Data Safety

Privacy & Legal

Resource Integrity

SPF

DMARC

DKIM

17 Recommendations Available

See actionable steps to improve your HIPAA security score.

View Recommendations

Ready to fix these issues? Our specialists can remediate every finding.

Fix My Website →

SSL/TLS Certificate Pass

Valid certificate - expires in 53 days (issued by Let's Encrypt)

HSTS Pass

✓ max-age=31536000

X-Content-Type-Options Pass

✓ nosniff

X-Frame-Options Fail

Missing. Recommended: SAMEORIGIN

Referrer-Policy Fail

Missing. Recommended: strict-origin-when-cross-origin

Permissions-Policy Fail

Missing. Recommended: geolocation=(), microphone=(), camera=()

Server Information Disclosure Warning

Server headers expose version/technology: cloudflare, WP Engine. Remove or redact to avoid leaking infrastructure details.

Cookie Security Flags Pass

No cookies were set by this page - no cookie security issues.

HTTP → HTTPS Redirect Fail

HTTP requests are not redirected to HTTPS. Visitors on http:// receive an unencrypted connection.

TLS Version Pass

Server enforces TLS 1.2 or higher - deprecated protocol versions are rejected.

Mixed Content Pass

No HTTP resources found loading on this HTTPS page.

Tracking Scripts Warning 1 found

1 third-party tracker(s) detected on this page.

Google Tag Manager

Google Tag Manager Warning

Third-party tracking script detected on this page.

Contact Email Addresses Warning

Off-domain email(s) found: [email protected], [email protected]. Consider using a @besowb.com address.

HTTPS Enforcement Pass

Page served over HTTPS.

Health Form Fields Warning

Health-related form content detected. Keywords: health, medical, patient, dob, ssn, condition, medication, hipaa. Ensure HIPAA-compliant safeguards are in place.

Tracker Exposure on Health Page Fail

Health-sensitive form content found alongside 1 tracker(s): Google Tag Manager. This may constitute a HIPAA/privacy violation.

A privacy policy link or reference was detected on this page.

Notice of Privacy Practices Pass

A Notice of Privacy Practices (NPP) reference was detected — required under HIPAA §164.520.

A Terms of Service / Terms of Use / Terms & Conditions link was detected.

HIPAA Notice Pass

A HIPAA Notice or dedicated HIPAA policy page was detected.

Cookie Policy Pass

A cookie policy, notice, or consent reference was detected.

Accessibility Statement Fail

No accessibility statement found. ADA compliance (Section 508 / WCAG 2.1) is increasingly required for healthcare websites serving the public.

Non-Discrimination Policy Fail

No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.

State Privacy Rights Notice Fail

No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.

Form Service Compliance Pass

No known non-HIPAA form services detected.

Chat Widget Risk Pass

No known non-HIPAA chat widgets detected.

Subresource Integrity (SRI) Warning

2 external script(s) lack SRI integrity attributes: analytics.nkpapps.com, cdn.trustindex.io. A compromised CDN could inject malicious code into your pages.

SPF Record Fail

No SPF record found. Add TXT record: v=spf1 include:_spf.google.com ~all

DMARC Record Fail

No DMARC record. Add TXT record at _dmarc.besowb.com: v=DMARC1; p=quarantine; rua=mailto:[email protected]

DKIM Record Warning

No DKIM record found on common selectors. Your mail provider may use a custom selector.

✨

Get an AI summary of this report

Open a new chat with your report pre-loaded

ChatGPT Claude Gemini

X-Frame-Options: Missing. Recommended: SAMEORIGIN

Referrer-Policy: Missing. Recommended: strict-origin-when-cross-origin

Permissions-Policy: Missing. Recommended: geolocation=(), microphone=(), camera=()

Server Information Disclosure: Server headers expose version/technology: cloudflare, WP Engine. Remove or redact to avoid leaking infrastructure details.

HTTP → HTTPS Redirect: HTTP requests are not redirected to HTTPS. Visitors on http:// receive an unencrypted connection.

Tracking Scripts: 1 third-party tracker(s) detected on this page.

Google Tag Manager: Third-party tracking script detected on this page.

Contact Email Addresses: Off-domain email(s) found: [email protected], [email protected]. Consider using a @besowb.com address.

Health Form Fields: Health-related form content detected. Keywords: health, medical, patient, dob, ssn, condition, medication, hipaa. Ensure HIPAA-compliant safeguards are in place.

Tracker Exposure on Health Page: Health-sensitive form content found alongside 1 tracker(s): Google Tag Manager. This may constitute a HIPAA/privacy violation.

Accessibility Statement: No accessibility statement found. ADA compliance (Section 508 / WCAG 2.1) is increasingly required for healthcare websites serving the public.

Non-Discrimination Policy: No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.

State Privacy Rights Notice: No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.

Subresource Integrity (SRI): 2 external script(s) lack SRI integrity attributes: analytics.nkpapps.com, cdn.trustindex.io. A compromised CDN could inject malicious code into your pages.

SPF Record: No SPF record found. Add TXT record: v=spf1 include:_spf.google.com ~all

DMARC Record: No DMARC record. Add TXT record at _dmarc.besowb.com: v=DMARC1; p=quarantine; rua=mailto:[email protected]

DKIM Record: No DKIM record found on common selectors. Your mail provider may use a custom selector.

Ready to Fix These Issues?

Our specialists can remediate every finding, protect your patients, and keep your website secure.

Fix My Website →

https://besowb.com