Íslenska

How this site is secured

A company that talks about security should pass its own check. This page lists only what was confirmed on vardis.is when the site was last built, 22 October 2026.

You can check every item yourself with the links next to it.

DNS and domain

  • DNSSEC

    Passed

    DNSSEC signs the DNS records, so nobody can send visitors or email to a fake address by forging DNS answers.

    primary AD=true
secondary AD=true
DS=true

  • CAA: who may issue certificates

    Passed

    CAA records name the certificate authorities allowed to issue certificates for the domain, which makes a wrongly issued certificate less likely.

    0 issue "comodoca.com"
0 issue "digicert.com; cansignhttpexchanges=yes"
0 issue "letsencrypt.org"
0 issue "pki.goog; cansignhttpexchanges=yes"
0 issue "ssl.com"
0 issuewild "comodoca.com"
0 issuewild "digicert.com; cansignhttpexchanges=yes"
0 issuewild "letsencrypt.org"
0 issuewild "pki.goog; cansignhttpexchanges=yes"
0 issuewild "ssl.com"

Email

  • SPF: who may send email

    Passed

    SPF lists the servers allowed to send email from the domain. Without it, anyone can send mail that claims to come from you.

    v=spf1
    Version. This is an SPF record.
    include:_spf.mx.cloudflare.net
    The mail servers this domain lists may send too.
    ~all
    Every other server soft-fails. Mail from them should be marked as suspicious.
    Source: RFC 7208

  • DMARC: forged email is rejected

    Passed

    DMARC tells receiving mail servers to reject email that fails SPF and DKIM checks for the domain. It is the main defence against invoice fraud and phishing in the company's name.

    v=DMARC1
    Version. This is a DMARC record.
    p=reject
    Policy. Mail that fails the check should be rejected.
    Source: RFC 9989

Website

  • HTTP redirects to HTTPS

    Passed

    Many visitors still type the address without https://. A permanent redirect sends them to HTTPS straight away, before anything can be intercepted.

    https://vardis.is/

  • www redirects to vardis.is

    Passed

    One address for the site. www.vardis.is permanently redirects to vardis.is, so every visitor ends up in one place with the same settings.

    https://vardis.is/

  • HSTS: always use HTTPS

    Passed

    HSTS tells browsers to use only HTTPS for the site from then on, so an attacker on public Wi-Fi cannot quietly switch a visitor to plain HTTP.

    max-age=31536000; includeSubDomains

  • Content Security Policy

    Passed

    A Content Security Policy limits which scripts a page may run. If an attacker injects code into the site, a strict policy stops it from running.

    default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; connect-src 'self'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'; require-trusted-types-for 'script'

  • X-Content-Type-Options

    Passed

    This header stops browsers from guessing file types, which attackers can abuse to run a file as a script.

    nosniff

  • Referrer-Policy

    Passed

    When a visitor follows a link, the browser may tell the other site which page they came from. Full addresses can leak internal paths.

    strict-origin-when-cross-origin

  • Permissions-Policy

    Passed

    The site turns off the camera, microphone, location and other features it does not use, also for any code that might get into it.

    accelerometer=(), autoplay=(), browsing-topics=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), xr-spatial-tracking=()

  • Cross-Origin-Opener-Policy

    Passed

    A page on another site that opens vardis.is gets no handle on its window.

    same-origin

  • Cross-Origin-Resource-Policy

    Passed

    Other sites cannot load vardis.is files into their own pages.

    same-origin

  • No software versions shown

    Passed

    Version numbers in headers and page code tell attackers which known vulnerabilities to try. None show here.

    cloudflare

  • No cookies

    Passed

    The site sets no cookies, so there is nothing to steal and nothing to consent to.

  • Nothing from third parties

    Passed

    Every page, font and script comes from vardis.is. No analytics, no ad networks, no third-party content networks.

  • security.txt

    Passed

    security.txt tells people who find a security problem how to reach us. Without it, warnings often go nowhere.