External posture for shop.examplepay.com needs some attention.
We ran a passive external scan across five areas and found 3 items worth a closer look.
47 checks run · 3 need attention. Findings are only the checks that did not pass.
Findings
The server accepted a handshake using TLS 1.0 and TLS 1.1 on port 443. Both protocol versions were deprecated by the PCI Security Standards Council and are disallowed for any system in scope of PCI DSS. Affected: shop.examplepay.com:443.
TLS 1.0/1.1 are vulnerable to known downgrade and padding-oracle attacks (BEAST, POODLE). Any card data transmitted over these protocol versions is not meeting the minimum transport security PCI DSS requires.
Disable TLS 1.0 and 1.1 at the load balancer or web server config, leaving TLS 1.2 and 1.3 as the only accepted versions. Most managed load balancers (ALB, Cloudflare, nginx with a modern ssl_protocols directive) support this as a single config change with no application-code impact.
PCI DSS 4.0.1 — Req 4.2.1
No Content-Security-Policy header was present on the response from https://shop.examplepay.com/. Without it, the browser enforces no restriction on which scripts, styles, or frames the page is allowed to load.
A missing CSP significantly widens the blast radius of any injected-script vulnerability elsewhere on the site (including third-party scripts) — the browser has no policy telling it to refuse to execute unexpected script sources.
Add a Content-Security-Policy header starting from a conservative default (default-src 'self') and widen it deliberately for the specific CDNs, analytics, or payment-widget origins the page actually needs. Ship it in Report-Only mode first to catch false positives before enforcing.
PCI DSS 4.0.1 — Req 6.4.3
The Server response header returned a specific version string (nginx/1.18.0) rather than a generic or suppressed value. Affected: shop.examplepay.com.
A version-specific banner tells an attacker exactly which CVE database to search — it doesn't create a vulnerability by itself, but it removes the reconnaissance step that would otherwise slow an attacker down.
Set server_tokens off; (nginx) or the equivalent directive for your web server so the Server header returns no version string. A five-minute config change with no functional impact.
PCI DSS 4.0.1 — Req 11.3.1