Fix My Website
HIPAA Report

https://lovedisappearingact.com

Oct 9, 2026 RPT-154437E0 View Site

* Rescans available every 24 hours

HIGH PRIORITY
3 failed · 5 warnings

* We detected the following that may create HIPAA privacy or security risks on your website.

22
Passed
3
Failed
5
Warnings
30
Checks
SSL / TLS
Security Headers
Transport Security
Cookie Security
Tracking Scripts
Contact Emails
Health Data Safety
Privacy & Legal
Resource Integrity
SPF
DMARC
DKIM
8 Recommendations Available
See actionable steps to improve your HIPAA security score.
View Recommendations
Ready to fix these issues? Our specialists can remediate every finding.
Fix My Website →
SSL / TLS
1 passed
SSL/TLS Certificate Pass
Valid certificate - expires in 85 days (issued by Let's Encrypt)
Security Headers
5 passed 1 warning
Fix My Website
HSTS Pass
✓ max-age=31536000; includeSubDomains
X-Content-Type-Options Pass
✓ nosniff
X-Frame-Options Pass
✓ SAMEORIGIN
Referrer-Policy Pass
✓ strict-origin-when-cross-origin
Permissions-Policy Pass
✓ camera=(), microphone=(), geolocation=()
Server Information Disclosure Warning
Server headers expose version/technology: nginx/1.29.8. Remove or redact to avoid leaking infrastructure details.
Cookie Security
1 passed
Cookie Security Flags Pass
No cookies were set by this page - no cookie security issues.
Transport Security
2 passed 1 failed
Fix My Website
HTTP → HTTPS Redirect Fail
HTTP requests are not redirected to HTTPS. Visitors on http:// receive an unencrypted connection.
TLS Version Pass
Server enforces TLS 1.2 or higher - deprecated protocol versions are rejected.
Mixed Content Pass
No HTTP resources found loading on this HTTPS page.
Tracking & Analytics
1 passed
Tracking Scripts Pass
No known third-party tracking scripts detected.
Contact Email Quality
1 warning
Fix My Website
Contact Email Addresses Warning
Off-domain email(s) found: [email protected]. Consider using a @lovedisappearingact.com address.
Health Data Safety
2 passed 1 warning
Fix My Website
HTTPS Enforcement Pass
Page served over HTTPS.
Health Form Fields Warning
Health-related form content detected. Keywords: health, medical, patient, dob, ssn, condition, medication, hipaa. Ensure HIPAA-compliant safeguards are in place.
Tracker Exposure on Health Page Pass
Health form content detected - no third-party trackers present.
Privacy & Legal
8 passed 2 failed
Fix My Website
Privacy Policy Pass
A privacy policy link or reference was detected on this page.
Notice of Privacy Practices Pass
A Notice of Privacy Practices (NPP) reference was detected — required under HIPAA §164.520.
Terms of Service Pass
A Terms of Service / Terms of Use / Terms & Conditions link was detected.
HIPAA Notice Pass
A HIPAA Notice or dedicated HIPAA policy page was detected.
Cookie Policy Pass
A cookie policy, notice, or consent reference was detected.
Accessibility Statement Pass
An accessibility statement, ADA compliance notice, or WCAG reference was detected.
Non-Discrimination Policy Fail
No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.
State Privacy Rights Notice Fail
No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.
Form Service Compliance Pass
No known non-HIPAA form services detected.
Chat Widget Risk Pass
No known non-HIPAA chat widgets detected.
Resource Integrity
1 warning
Fix My Website
Subresource Integrity (SRI) Warning
6 external script(s) lack SRI integrity attributes: www.googletagmanager.com, analytics.ahrefs.com, widgets.leadconnectorhq.com, reputationhub.site. A compromised CDN could inject malicious code into your pages.
Email Authentication
2 passed 1 warning
Fix My Website
SPF Record Pass
v=spf1 ip4:50.6.3.12 a mx include:websitewelcome.com ~all
DMARC Record Warning
DMARC found but policy is 'none' - no enforcement, email spoofing is not blocked. Upgrade to p=quarantine or p=reject. Record: v=DMARC1; p=none
DKIM Record Pass
Found on selector 'default': v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn4xdlEUCNKR+vUh22o…
✨

Get an AI summary of this report

Open a new chat with your report pre-loaded

ChatGPT Claude Gemini
8 Recommendations
1
Server Information Disclosure: Server headers expose version/technology: nginx/1.29.8. Remove or redact to avoid leaking infrastructure details.
2
HTTP → HTTPS Redirect: HTTP requests are not redirected to HTTPS. Visitors on http:// receive an unencrypted connection.
3
Contact Email Addresses: Off-domain email(s) found: [email protected]. Consider using a @lovedisappearingact.com address.
4
Health Form Fields: Health-related form content detected. Keywords: health, medical, patient, dob, ssn, condition, medication, hipaa. Ensure HIPAA-compliant safeguards are in place.
5
Non-Discrimination Policy: No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.
6
State Privacy Rights Notice: No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.
7
Subresource Integrity (SRI): 6 external script(s) lack SRI integrity attributes: www.googletagmanager.com, analytics.ahrefs.com, widgets.leadconnectorhq.com, reputationhub.site. A compromised CDN could inject malicious code into your pages.
8
DMARC Record: DMARC found but policy is 'none' - no enforcement, email spoofing is not blocked. Upgrade to p=quarantine or p=reject. Record: v=DMARC1; p=none
Ready to Fix These Issues?
Our specialists can remediate every finding, protect your patients, and keep your website secure.
Fix My Website →