Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11You can audit the four controls in about 20 focused minutes if you inspect the live HTTPS response, query DNS directly, and record what you found. CSP and HSTS protect browser traffic; SPF and DMARC govern authenticated email; CAA limits which certificate authorities may issue for your domain. The procedure below shows exactly what to check, what a weak result means, and how to remediate without taking production dependencies by surprise.
What this 20-minute audit actually verifies
This is a point-in-time check of the production hostname, its redirects, the domain’s DNS records, and the services that send mail or obtain certificates for the domain. It is not a penetration test and it cannot prove that an application has no vulnerabilities. A useful record for every check contains the timestamp, hostname, HTTP status or DNS answer, the observed value, the expected value, the owner, and the planned verification date.
As an Amazon Associate I earn from qualifying purchases.
| Control | Where you inspect it | What it controls | Typical failure impact |
|---|---|---|---|
| Content Security Policy (CSP) | HTTPS response header | Which scripts, styles, frames, connections, images, fonts and other resources a browser may use | Content-injection and cross-site-scripting exposure, or broken application features after an overly strict change |
| HTTP Strict Transport Security (HSTS) | HTTPS response header | Whether a browser upgrades future HTTP requests to HTTPS for a declared period | Downgrade or first-visit exposure; an unsafe subdomain policy can make sites unreachable |
| SPF | DNS TXT record at the sending domain | Which systems are authorized to send mail for the domain | Spoofed mail, delivery failures, or an unmaintainable include chain |
| DMARC | DNS TXT record at _dmarc.example.com |
Alignment of SPF or DKIM with the visible From domain, enforcement policy and reporting | Unactioned spoofing, privacy problems in reports, or legitimate mail rejected by receivers |
| CAA | DNS CAA records at the domain and applicable ancestors | Which certificate authorities are authorized to issue certificates | Unintended issuance or an interrupted renewal when an incumbent CA is removed |
CSP is defense in depth. It does not replace input validation, output encoding, secure session handling or dependency patching. HSTS is a browser policy, not a repair for mixed content, expired certificates or an HTTP endpoint that still accepts sensitive data.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesMinutes 0–3: establish scope and collect evidence
Choose the names that matter
Start with the canonical production hostname, the apex domain, every mail-sending subdomain, and the certificate names used by the service. Note whether the canonical host redirects from HTTP to HTTPS, whether a CDN or reverse proxy terminates TLS, and whether different paths are served by different origins. A header added at an origin can disappear at a proxy, while a proxy can add a header the origin team cannot see.
#1 Best Overall
Capture a reproducible baseline
Use a browser’s network panel or an HTTP client against the live HTTPS URL. Save the response status and all security-relevant headers. A command-line baseline can look like:
curl -sS -D - -o /dev/null https://www.example.com/Query DNS with a validating resolver and save the complete answer, including its TTL and any chained records. For example:
dig +dnssec TXT example.com
dig +dnssec TXT _dmarc.example.com
dig +dnssec CAA example.comThese commands are evidence collection, not a pass/fail oracle. DNS caching, split-horizon DNS, and proxy configuration can produce different answers from different networks, so record which resolver and vantage point you used.
Recommended Free Tools
Minutes 3–8: check and safely deploy CSP
Inspect the enforced header
Look for Content-Security-Policy on the HTTPS response. The response header is the preferred delivery mechanism. At minimum, review the directives that describe your application’s actual behavior:
default-srcas the fallback policy.script-srcfor JavaScript, including whether nonces or hashes are used.style-srcfor stylesheets and inline style requirements.object-src, commonly restricted to'none'when legacy plug-ins are unnecessary.base-urito prevent an attacker from changing the document base URL.frame-ancestorsto control who may embed your pages.form-actionto limit form submission destinations.- Source lists for connections, images and fonts that the application genuinely loads.
Flag 'unsafe-inline' and 'unsafe-eval' for review. Do not remove either token blindly: first identify the inline code, framework, analytics component or vendor that requires it. Replace inline scripts with nonces or hashes where practical, and remove obsolete origins from source lists.
Use report-only before enforcement
If there is no enforced policy, deploy an equivalent Content-Security-Policy-Report-Only header first. Collect violation reports while exercising login, checkout, account, search and other critical flows. Remove stale or unexpected origins, document each legitimate dependency and assign an owner before switching to the enforcing header.
Report-only mode observes policy effects without blocking resources. An enforced policy can immediately break analytics, payment widgets, identity providers or inline application code. Treat every violation as a dependency investigation, not as permission to add a broad wildcard. A policy that allows every script origin may look complete while providing little protection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Record a CSP finding
Classify the result as one of three states: missing, present but weak, or present and verified. “Present and verified” requires a live response check and successful tests of the application’s important flows, not merely a configuration-file review.
Minutes 8–11: verify HSTS without locking out subdomains
Inspect only an HTTPS response
Check for Strict-Transport-Security on the HTTPS response. Confirm that max-age is meaningful for your risk tolerance and deployment process. An HTTP response cannot safely establish HSTS because a network attacker could modify it before the browser receives it.
Decide on includeSubDomains
Add includeSubDomains only after every covered subdomain can serve HTTPS with a valid certificate and a working application. Inventory forgotten hosts, development names, monitoring endpoints, mail-related web interfaces and vendor-managed subdomains first. One unreachable included subdomain can become an operational incident for users.
Treat preload as a separate commitment
preload is not just another strength setting. It represents an operational commitment to keep HTTPS available for the domain and its covered subdomains. Test HTTP-to-HTTPS redirects, certificate renewal, direct HTTPS access and mixed-content behavior before pursuing preload. HSTS does not repair certificate errors or mixed content; fix those independently.
Minutes 11–15: audit SPF and DMARC together
Enumerate every legitimate sender in SPF
Query the SPF TXT record at the domain that appears in the envelope-from or return-path of your mail. SPF records must be published as DNS TXT records. List every authorized provider, including transactional systems, support desks, marketing platforms, on-premises gateways and subdomains that send separately.
Remove abandoned services and inspect nested include chains for unnecessary DNS lookups. A record that still authorizes a retired provider is a standing spoofing risk; a complex chain can also exceed SPF’s DNS-lookup limit and cause an otherwise legitimate message to fail. Keep the final record understandable enough that the next owner can remove a provider safely.
Read the DMARC record at _dmarc
Query _dmarc.example.com and record these tags when present:
p: the policy for the organizational domain.sp: a different policy for subdomains.rua: aggregate-report destinations.ruf: failure-report destinations, if used.adkimandaspf: strict or relaxed alignment modes.pct: the percentage of messages to which the policy applies.
DMARC evaluates SPF and DKIM, then checks whether at least one passing mechanism aligns with the visible From domain. SPF can pass for a sender while DMARC fails if the authenticated envelope domain is unrelated to the From domain. The same alignment issue applies to DKIM’s signing domain.
Move from observation to enforcement
Start with p=none while collecting aggregate reports and correcting legitimate senders. Use those reports to identify forgotten services and alignment failures. After real mail consistently passes, move deliberately toward p=quarantine and then p=reject, using a staged pct value when your receiving ecosystem supports it. Confirm that report destinations are controlled and appropriate for the message data they may contain.
The standards landscape changed on May 20, 2026: DMARC.org reports RFC 9989 for the core protocol, RFC 9990 for aggregate reporting and RFC 9991 for failure reporting, updating and obsoleting RFC 7489. Check the current specifications and each provider’s implementation before changing policy tags; do not assume older guidance describes every current behavior.
Minutes 15–18: check CAA and certificate renewal paths
Find effective authorization
Query CAA at the apex and relevant DNS ancestors. List every issue, issuewild and iodef value, then compare those values with the certificate authorities your organization actually uses. CAA is an authorization control for certificate issuance: it lets the domain holder specify which CAs may issue certificates for the name.
Rank #4
A missing CAA record is not automatically a vulnerability if certificate issuance is governed elsewhere. An unexpected authorized CA, however, is a concrete finding. Before removing an incumbent CA, test a complete renewal in a controlled window, including DNS or HTTP challenge validation, wildcard issuance if used, and deployment of the renewed certificate at every TLS termination point.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Understand wildcard scope
Review issuewild separately from issue. A policy that permits a CA to issue ordinary names may not express the same intent for wildcard certificates. Keep the authorization list as narrow as operationally possible and document who owns each value.
Minutes 18–20: turn observations into a remediation record
For each control, create one entry with the following fields:
- Observed value: the exact header or DNS answer, including status and timestamp.
- Expected value: the policy your application, mail architecture or certificate process requires.
- Evidence: the URL, command, resolver and saved response or DNS output.
- Risk: what an attacker, user or dependent service could experience.
- Owner and change: the person responsible and the smallest safe modification.
- Rollback: the previous header or DNS record and the procedure to restore it.
- Verification date: when the live response and dependent workflows will be retested.
Separate “missing,” “present but weak” and “present and verified.” Schedule a retest after deployment and retain the prior header and DNS snapshot so a regression is detectable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and recovery steps
The header exists at the origin but not on the public site
Inspect the response after the CDN or reverse proxy, not only the origin response. Configure the policy at the layer that serves the public response, then confirm that redirects, error pages and cached objects do not omit it.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →A new CSP blocks a critical feature
Use the browser’s violation details to identify the blocked resource, its owner and the required destination. Restore the previous policy or return temporarily to report-only, fix the dependency, and re-enforce with the narrowest source, nonce or hash that works.
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
HSTS makes a forgotten host fail
Do not remove HSTS as a first reaction. Identify the included subdomain, provision a valid certificate and HTTPS service, or remove includeSubDomains through a controlled change if that host cannot be brought into scope. Re-test every covered name.
DMARC rejects legitimate mail
Use aggregate reports and message authentication results to locate the sender that fails alignment. Correct SPF authorization or DKIM signing and ensure the signing or envelope domain aligns with the visible From domain before increasing enforcement again.
CAA breaks renewal
Compare the failed renewal’s CA with the live CAA values. Restore the required authorization or complete the migration to an authorized CA, then verify issuance and installation before the next expiry window.
Choosing an implementation point
When deciding where to make changes, compare the enforcement point, blast radius, observability, multi-provider support and operational ownership.
| Control | Primary enforcement point | Change behavior | Key ownership question |
|---|---|---|---|
| CSP | Origin or CDN response | Browser behavior can change immediately, especially on cached pages | Who owns every script, frame and external connection? |
| HSTS | Origin or CDN HTTPS response | Browsers remember the policy for max-age |
Can every included host remain HTTPS-capable? |
| SPF/DMARC | DNS and mail-provider configuration | DNS caching and provider workflows delay changes | Who owns each sender and each report destination? |
| CAA | DNS | Issuance and renewal depend on effective DNS authorization | Which CA is responsible for every current certificate? |
A single pass is useful only when it ends with named owners, rollback material and a retest date. The controls reinforce one another, but none substitutes for secure application coding, reliable TLS operations or disciplined mail-sender inventory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
