Question 1

What exactly does this compliance and GDPR quick check inspect?

Accepted Answer

The scanner automatically inspects 4 core dimensions: (1) SSL/TLS encryption validity and cipher strength, (2) Presence of critical HTTP security headers such as HSTS, CSP, and X-Content-Type-Options, (3) Discoverability of mandatory legal pages (privacy policy and imprint), and (4) External asset transfers such as dynamically loaded Google Fonts without local hosting.

Question 2

Does this scan pose any risk to my website or data?

Accepted Answer

No. The check performs only passive standard HTTP(S) requests, exactly like a normal web browser. No aggressive penetration tests or load tests are executed. No sensitive business data is stored.

Question 3

Why are dynamic Google Fonts and missing HSTS headers a legal and security risk?

Accepted Answer

Under German and EU privacy regulations, transferring visitors' IP addresses to US servers without prior consent violates GDPR requirements and has triggered widespread warning letters. Missing security headers like HSTS also leave visitors vulnerable to man-in-the-middle attacks.

Question 4

How can cyberEiche assist in fixing discovered issues?

Accepted Answer

cyberEiche offers professional VAPT audits (Vulnerability Assessment & Penetration Testing) and end-to-end technical remediation: We self-host fonts locally, harden webserver headers, and secure your IT infrastructure against vulnerabilities.

Website Compliance & GDPR Check

SSL & TLS Encryption

Security Headers

GDPR & US Transfers

Legal Pages & Imprint

Frequently Asked Questions about the Website Compliance Check