Harbourview Law LLP External Cybersecurity Assessment

Every step here is your decision. We mark what we recommend first; Skip records that you considered it.

Next: Your site is missing 6 browser protections · About 20 minutes

Show me how
Where it is doneYour website
1. At your web host, add these response headers to every page of your site: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
2. Set them wherever your site's response headers are set: your web server settings, your host's control panel or your CDN.
3. Then run the check shown here and confirm each one appears.
What changesVisitors see no difference. Browsers follow the new setting quietly.

Can it stay onIt stays on.

To undo itRemove the setting in the same place if a page stops working and tell us.
Go to this finding
DNSSEC not enabledAbout 20 minutes
Show me how
Where it is doneYour DNS settings
1. Enable DNSSEC at your DNS provider.
2. Most providers now offer it as a single setting; it signs your records so they cannot be quietly altered in transit.
What changesNothing changes for your clients or staff. The name stops pointing somewhere you no longer use.

Can it stay onIt stays as it is once done.

To undo itThe old record can be added back in the same DNS settings if something you still use stops answering.
Go to this finding

See all (8 open)

Your robots.txt file publicly lists internal paths (/wp-admin/)About 15 minutes
Show me how
Where it is doneYour website
1. At your web host, remove internal and administrative paths from robots.txt.
2. The file is public, so listing a path there advertises it rather than hiding it.
What changesVisitors see no difference. Browsers follow the new setting quietly.

Can it stay onIt stays on.

To undo itRemove the setting in the same place if a page stops working and tell us.
Go to this finding
MTA-STS not configuredAbout 30 minutes
Show me how
Where it is doneYour DNS settings
1. Publish an MTA-STS policy and a TLS-RPT record so mail to your domain cannot be silently downgraded to an unencrypted connection.
What changesInboxes that receive mail in your firm's name follow the rule you publish. Mail your firm really sends keeps arriving; the reports show any service that still needs adding.

Can it stay onIt stays on for good. Nobody needs to touch it day to day.

To undo itIf real mail is turned away, set the policy back one step in the same record (p=quarantine or p=none) and mail flows again while the missing service is added.
Go to this finding
TLS-RPT reporting not configuredAbout 20 minutes
Show me how
Where it is doneYour DNS settings
1. Add a TXT record named _smtp._tls for your domain with the value v=TLSRPTv1; rua=mailto:[email protected].
2. Use an address someone reads.
3. Mail servers then send you a daily report whenever encrypted delivery to your domain fails.
What changesInboxes that receive mail in your firm's name follow the rule you publish. Mail your firm really sends keeps arriving; the reports show any service that still needs adding.

Can it stay onIt stays on for good. Nobody needs to touch it day to day.

To undo itIf real mail is turned away, set the policy back one step in the same record (p=quarantine or p=none) and mail flows again while the missing service is added.
Go to this finding
WordPress publishes its author listAbout 20 minutes
Show me how
Where it is doneYour domain and website settings
1. Disable the WordPress REST users endpoint, or restrict it to authenticated requests.
2. Most security plugins expose this as one toggle.
What changesNothing changes for your clients or staff day to day.

Can it stay onIt can stay as it is once done.

To undo itEach change is made in one place and can be reversed there.
Go to this finding
An online storage folder with your firm's name exists, called harbourview-llp. We could not open it and cannot tell whose it is. Please say whether it is yoursAbout 15 minutes
Show me how
Where it is doneYour domain and website settings
1. Confirm on your dashboard whether this storage account is your firm's. If it is not, answer no there and this closes; nothing needs doing.
2. If it is yours, check that public access is blocked at the account level and on the folder itself.
3. If it is yours, check who can change that setting and rotate any access keys that have ever had write access.
4. If it is yours, turn on access logging and an alert on any change to the public-access setting.
What changesFiles there are no longer open to anyone with the address. People you share with get a link of their own.

Can it stay onIt stays private.

To undo itSharing can be turned back on for one file in the same account.
Go to this finding
One step further2 minutes

Nothing has been seen from this name yet. If you want to go one step further, this is the note to send.

A note to our clients from Harbourview Law LLP.
We never change our wiring instructions or bank details by email. If an email asks you to pay to a new account, or says our details have changed, do not reply to it and do not pay. Call us on the number you already have for us, not a number given in that email.
Our own address is harbourview-llp.example. Thank you for checking with us first.
Show me how
Where it is doneYour own email
1. Press Copy message.
2. Paste it into an email to your clients, or into your next update to them.
3. Send it from your usual address.
What changesYour clients know to call before they pay to new details.

Can it stay onYou can keep the last line in every email that carries payment details. A rule for you, not part of the message: If a suspicious sender asks who checks your email security, do not say.

To undo itNothing to undo.

Send to my insurer or broker

Your record, dated, with a fingerprint anyone can check. A one-page summary of the email-security questions renewal forms ask, answered from your record.

View the summary Download

Start with these two

Your 2 open ways in (1 at your assessment, 1 found since), most serious first. Each fix comes with a check anyone can run to prove it is done.

Fix 1: Set your email to reject forged mail

HighNothing tells mail servers to refuse email forged in your nameSee the finding for Nothing tells mail servers to refuse email forged in your name

Attackers can send fake invoices and emails from your domain and recipients have no authoritative way to reject them.

Where it is doneYour DNS settings
Rough timeAbout 20 minutes a stage, over two to four weeks

Proof it is done

Run this. At each stage it returns the policy in force; the fix is done when it shows p=quarantine or p=reject.

dig TXT _dmarc.harbourview-llp.example +short @1.1.1.1

Not sent yet

The exact record to paste, written for your DNS host. It is the first of three stages over two to four weeks and each stage waits for you.

These steps take about 20 minutes in the account where your domain is managed. If you get stuck, reply to your delivery email and a person at [email protected] will help. We answer questions about the steps; we do not make the change in your account.

The steps (11)

In the Microsoft Defender portal, go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings. Open the DKIM tab and check that signing is on for harbourview-llp.example. If it is not, publish the two CNAME records it shows at your DNS host and turn signing on.
Your SPF record lists one service that sends mail for harbourview-llp.example (Microsoft 365), so start at p=quarantine. Publish this record at _dmarc.harbourview-llp.example: v=DMARC1; p=quarantine; rua=mailto:[email protected]
The reports go to the LeakTrace report desk at [email protected]. You can put a mailbox of your own in its place.
Sign in to the company that runs the DNS for harbourview-llp.example. It is the one whose name servers your domain uses, which is not always where you bought the domain.
Open the DNS records for harbourview-llp.example. The screen is usually called DNS, DNS records or Zone editor.
Add a new record and choose the type TXT.
Type _dmarc as the name. If the screen does not add your domain itself, type _dmarc.harbourview-llp.example.
Paste the record above as the value, exactly as copied.
Save the record.
Read the reports for about two weeks. When no mail your firm really sends is landing in spam, change p=quarantine to p=reject in the same record.
The general steps for any DNS host are at getleaktrace.com/fix/.

If this is used against you

Mail forged in your name tells a client to pay somewhere new. Reported spear phishing losses averaged roughly $119,000 per victim in 2025.

Source: Canadian Anti-Fraud Centre

Fix 2: Reset the exposed logins and require a second sign-in step

High14 firm addresses on your domain appear in monitored breach databases

See the finding for 14 firm addresses on your domain appear in monitored breach databases

14 firm addresses on harbourview-llp.example are present in monitored breach databases.

Where it is doneEach account named
Rough timeAbout 30 to 60 minutes an account

Proof it is done

In your email admin console, each exposed account shows a new password and multi-factor sign-in enforced.

Not sent yet

The steps (4)

Set a new password for each listed address in the Microsoft 365 admin center. Start with whoever moves money: anyone who sends invoices, approves payments or handles closings.
Turn on a second sign-in step for each of them. Go to mysignins.microsoft.com/security-info (Security info). A sign-in method other than your password should be listed, such as the Authenticator app or a phone.
Check each listed mailbox for forwarding and inbox rules nobody created. In Outlook on the web or the new Outlook: Settings, Mail, Rules. Then Settings, Mail, Forwarding. Look for any rule or forwarding address you did not set up yourself.
Check its recent sign-ins. Go to myaccount.microsoft.com and choose Recent activity (your My Sign-Ins page). Open each sign-in and check that you recognise the place and the device.

If this is used against you

If a password was reused on a listed address, someone can open that mailbox and redirect a payment. Reported spear phishing losses averaged roughly $119,000 per victim in 2025.

Source: Canadian Anti-Fraud Centre

Discover

What we watch

Read from outside, the way an attacker would

What changed since your assessment

30 Oct 2026

Found after your assessment

14 more firm addresses appeared in monitored breach databases.

Your assessment is a record of 29 Sep 2026. Each change below was found by the watch after that date and each one carries its fix.

30 Oct14 more firm addresses appeared in monitored breach databases.

Open monitoring

harbourview-llp.exampleOpen: 2Closed: 0

Email: can it be forgedOpen

1 open, 2 settings to tidy. At your assessment: no DMARC record is published. At the latest check: a DMARC record is published at p=none (reports only; forged mail is not refused).
Look-alike domainsNothing open

Checked, nothing open
Firm addresses in breach listingsOpen

1 open, 14 found in a later check
Website and serversNothing open

Checked, nothing open, 5 settings to tidy
Keys in your website codeNothing open

Checked, nothing open
What AI assistants say about youNot in this record

Not part of this record

Your AI security agent

It answers from your firm’s own findings and cites each one. It drafts a note about any finding for you to send and it re-checks a finding when you approve it. When your findings do not answer a question, a person replies.

Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it.

Ask about your findings

Try: “What should we fix first?”, “Draft a note about Finding 02”, “Finding 02 is fixed, check it again”.

AI agent activity

What the outside checks and your AI agent did for your firm, newest first. Running for your firm: email settings are re-checked every 5 minutes, new certificates for your domain and for look-alikes of your name are seen within minutes, new look-alike registrations are looked for every hour and everything else is re-checked in full every day.

What your AI agents can and can't do

29 SepDiscoverRead your firm from outside: 2 found, each with its evidence.

Registered domains with names close to yours

6 listed

Each domain is graded from what we read about it from outside, never from who we think owns it. Only the ones graded “worth a look” are raised as findings. The others are listed so you can see they were found.

harbourviewllp.example

Registered, nothing more known. harbourviewllp.example: has a website. One sign only (its name is one character off a name longer than six letters), not enough to grade it a concern.

harbourview-llp-law.example

Registered, nothing more known. harbourview-llp-law.example: has a website. Nothing more is known about it.

harbourviewllplaw.example

Registered, nothing more known. harbourviewllplaw.example: has a website. Nothing more is known about it.

harbourview-llp-legal.example

Registered, nothing more known. harbourview-llp-legal.example: has a website. Nothing more is known about it.

myharbourviewllp.example

Registered, nothing more known. myharbourviewllp.example: has a website. Nothing more is known about it.

harbourview-llps.example

Registered, nothing more known. harbourview-llps.example: has a website. One sign only (its name is one character off a name longer than six letters), not enough to grade it a concern.

Dated and sourced

Seen this week, matched to you

Matched on the way in the source reported. It does not mean your firm was affected.

7 Oct 2026The Record

Arizona court system

Way in, as reported: email made to look like it came from a trusted sender.

Open on yours: Nothing tells mail servers to refuse email forged in your name. Fix 1 closes this.

Validate

Open and closed, with the proof

What was publicly visible from outside on 29 September 2026. It does not cover your internal systems.

2 ways in open (1 at your assessment, 1 found since) 0 marked fixed, re-check pending 0 confirmed 7 settings to tidy

OpenMarked fixed, re-check pendingConfirmed

Email

1 finding

Finding 02 Open

Nothing tells mail servers to refuse email forged in your nameTechnical name: No DMARC record

Attackers can send fake invoices and emails from your domain and recipients have no authoritative way to reject them. Checked 29 Sep 2026. At your assessment (29 Sep): no DMARC record is published. At the latest check (30 Oct): a DMARC record is published at p=none (reports only; forged mail is not refused).

Proof

dig TXT _dmarc.harbourview-llp.example +short @1.1.1.1

Firm logins

1 finding

Finding 01 Open

Firm addresses in breach data

Found in a later check on 30 Oct. Your assessment did not list any. 14 addresses on harbourview-llp.example are present in monitored breach databases. The lookup returned a count and no names. To check the addresses your people use, run the named address check under Share and export.

Proof

14 addresses on harbourview-llp.example are present in monitored breach databases.

Settings to tidy

7 items

Worth fixing. None of these opens your firm to anyone by itself, so they are not counted as ways in.

Finding 03 Open

Your site is missing 6 browser protectionsTechnical name: Missing security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

Missing: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Checked 29 Sep 2026.

Proof

curl -sI https://harbourview-llp.example/

Finding 04 Open

Your domain's address records are not signedTechnical name: DNSSEC not enabled

Your domain's traffic can be redirected to a fake version of your website without detection. Checked 29 Sep 2026.

Proof

dig DNSKEY harbourview-llp.example @1.1.1.1 +dnssec

Finding 05 Open

A public file on your site lists the addresses of its private areasTechnical name: robots.txt lists internal paths

This tells attackers exactly where to look for admin panels and private areas. Checked 29 Sep 2026.

Proof

curl -s https://harbourview-llp.example/robots.txt

Finding 06 Open

Email on its way to you is not required to travel encryptedTechnical name: MTA-STS not enforced

Other mail servers are not required to use an encrypted connection when they send email to you. Checked 29 Sep 2026.

Proof

dig TXT _mta-sts.harbourview-llp.example +short @1.1.1.1 ; curl -s https://mta-sts.harbourview-llp.example/.well-known/mta-sts.txt

Finding 07 Open

You get no reports when email to you fails to arrive securelyTechnical name: TLS-RPT not set up

You get no notice when another mail server cannot deliver email to you over an encrypted connection, so a delivery problem or an attempt to interfere would go unseen. Checked 29 Sep 2026.

Proof

dig TXT _smtp._tls.harbourview-llp.example +short @1.1.1.1

Finding 08 Open

Your website lists the names of the accounts that can sign in to itTechnical name: WordPress user list exposed

Your website lists the usernames of the people who can sign in to it, which leaves only the password to guess. Checked 29 Sep 2026.

Proof

curl -s https://harbourview-llp.example/wp-json/wp/v2/users | jq

Finding 09 Open

An online storage folder with your firm's name exists, called harbourview-llp. We could not open it and cannot tell whose it is. Please say whether it is yours

Waiting for your answer.

Is this storage account yours? It is called harbourview-llp. Anyone can pick any storage name, so we cannot tell whose it is. If it is not yours, answer no and this closes.

Proof

curl -sI https://harbourview-llp.blob.storage.example/?comp=list

Recorded for context

2 notes

Facts recorded for context. There is nothing here for your firm to close, so none of it is counted.

Note

The system your website is built on needs its add-ons kept up to dateTechnical name: WordPress detected

This is the most targeted website platform in the world. Any outdated plugin or theme is an entry point for attackers. Checked 29 Sep 2026.

Proof

curl -s https://harbourview-llp.example/robots.txt | grep -i wp-

Note

Your website shares its internet address with many other sitesTechnical name: Shared IP address

If any one of them gets blacklisted for spam, malware, or fraud, your site can be blocked alongside them with no warning. Checked 29 Sep 2026.

Proof

Your website shares an IP address with 500+ other sites: if any of them get blacklisted, your site can be blocked too

A fix for the software behind your website was published on 21 October; your site shows a version from before it

Your site shows PHP 8.2. Published on 21 Oct 2026, after this reading. The version your site shows (8.2) has no patch level, so the version your site shows is in the affected range unless it has been updated.

What to do. Update PHP to 8.2.35, or to the newest fixed release.

What changes. Nothing changes for your visitors. The server runs the newer PHP.

Can it stay on. Yes. The updated PHP can stay on.

How to undo it. Not needed. The fixed releases are updates within the same branch.

Where the change is made. Your web host.

We compare the version number your site shows. A fix applied behind an unchanged number is the one thing an outside reading cannot see. Source: PHP release announcements (php.net), read 21 Oct 2026.

Is anyone already inside? How to check

Worded for Microsoft 365

These are the usual ways payment fraud reaches a firm. Each one ends with a message that looks like yours, sent just before a closing, a settlement or a trust-account payment.

Someone's mailbox is already being readIt is a common way in. It can be your firm, a client, or someone else in the deal. If a password from an old breach still works and no second sign-in step is asked for, one quiet forwarding rule is enough to read every payment email.
Public recordsProperty and court filings, your website, staff pages and posts that mention a deal.
Someone else in the dealA client, a supplier, a bank or another firm in the same payment has a mailbox that is being read.
Mass campaignsLook-alike names registered for many firms at once, waiting for any payment.

A finding is a reason to check, not proof that anyone is inside. We read from outside only and we never go inside your systems or anybody's mailbox.

What raises the odds that it is your own mailbox: your addresses listed in breach data, no second sign-in step, a look-alike that copies your exact email signature or names a real matter and a look-alike registered the same week as a real payment.

A reset of every account at your firm is your call. We recommend it when addresses are listed in breach data and a live look-alike appear together, or when anything unusual turns up in the rules or sign-in checks.

Each check, step by step

How toReset the passwords of everyone who handles money

If a password from an old breach of another service is reused, it is the usual way into a mailbox.

StepsEveryone who handles payments sets a new password, used nowhere else, in their email account's security settings.
What you will noticeEach person signs in again with the new password on their phone and computer.
Can it stay on?Yes. A new password stays as it is.
To adjust or undo itA password change is not undone. If someone is locked out, set a new one the same way.

How toTurn on a second sign-in step for every account

If a password is stolen, an account that asks for a second step still stays closed.

StepsGo to mysignins.microsoft.com/security-info (Security info). A sign-in method other than your password should be listed, such as the Authenticator app or a phone.
What you will noticeSigning in on a new device asks for a code or an app prompt as well as the password.
Can it stay on?Yes. It is meant to stay on for every account.
To adjust or undo itIt is changed or switched off in the same place. We do not recommend switching it off.

How toLook for forwarding and inbox rules nobody created

A quiet rule that forwards mail out or hides replies about payments is how a mailbox is read.

StepsIn Outlook on the web or the new Outlook: Settings, Mail, Rules. Then Settings, Mail, Forwarding. Look for any rule or forwarding address you did not set up yourself.
What you will noticeNothing changes for the person. You are looking for a rule or an address nobody set up.
Can it stay on?Nothing is switched on. Delete only a rule or forwarding address nobody set up.
To adjust or undo itA deleted rule can be made again in the same place if it turns out someone did set it up.

More2 more checks

Check recent sign-ins for places nobody was. A sign-in from a place or device nobody at the firm uses is the clearest sign to act on.

StepsGo to myaccount.microsoft.com and choose Recent activity (your My Sign-Ins page). Open each sign-in and check that you recognise the place and the device. In Microsoft 365 this list is the sign-in log.
What you will noticeA list of recent sign-ins with places and devices. Nothing changes.
Can it stay on?Nothing is switched on. It is a look.
To adjust or undo itNothing to undo. If a sign-in is not yours, reset that password and check its rules.

Tell clients how you change payment details. A client who expects a call never acts on an email with new bank details.

StepsAdd one line to your email signature, your invoices and your engagement letters: "We never change payment details by email. Call the number you already have for us." Separately, a rule for you and your staff, not for the signature: Never name LeakTrace or any security provider in a reply to a suspicious sender.
What you will noticeClients call you before acting on a change to payment details.
Can it stay on?Yes. Keep it on every invoice and in your signature.
To adjust or undo itRemove the line from your signature or your templates.

Checked and clear

We read the eleven things that reach law firms on 30 October: seven clear, two open and two to tidy.

Look-alike namesClear
Names made from yours, each asked whether it is registered and set up for mail.
Files your site should not showClear
Common addresses for configuration files, code folders and cloud storage.
Keys in your website's codeClear
The scripts your front page loads, for keys and passwords left in them.
Software versionsClear
The versions your website and its script libraries show.
Host names on your domainClear
4 host names on your domain, from its own records and public certificate logs.
Your domain's registrationClear
Its registry record: the expiry date and the lock that refuses a move to another registrar.
Spam, malware and phishing listsClear
Whether your domain or its server is on a spam, malware or phishing list.

Listed with the findings, or not read

Forged email in your nameOpen
The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM).
A way in that is open. Listed with the findings.
Firm addresses in breach dataOpen
Breach records for addresses at your own domain.
Fourteen addresses at your domain are listed. Listed with the findings.
Your website's certificateA setting to tidy
The certificate your website answers with: its name, its dates and who issued it.
A setting to tidy. Listed with the findings.
Your website's settingsA setting to tidy
The headers and cookies your website sends to every visitor.
A setting to tidy. Listed with the findings.

Since your assessment

Since your assessment on 30 October: two new findings listed; your records read again on 30 October.

30 OctoberYour domain asks mail servers to report email forged in your name, not to stop it. Found on 30 October, after your assessment.
30 OctoberFourteen firm addresses found in breach data on 30 October. Your assessment listed none.
30 OctoberYour records were read again on 30 October.

Inside, confirmed by your team

Not on

Our reading is from outside. What only your own people can see, they check themselves: each person on your list gets a short email on your schedule with a few things to look at in their own email account and records what they found here with the date. You get an email at once if anyone finds something or could not do a check.

These are your team's own confirmations, each with its date. We do not go inside your email or systems, so we have not checked them. They are not findings and they do not change your count of ways in or your rating.

How often

The inside checklist is not on. Choose how often, add the people to include and save.

Your mail is received by Microsoft 365, as our outside reading saw it, so each step is worded for it.

Who gets it

You[email protected]. Once a month the list sent to you also asks about accounts of former staff, the list of admins, a backup test, what your email AI assistant may do with mail from outside, your office computers and your office network.

Check our office connection

Not added

Your assessment reads your domain and your website. The internet connection at your office is another address and only you can tell us which one it is.

Press the button while you are connected at the office. We show you the address first and nothing is added until you confirm.

Your data and research

We build de-identified data sets from how public security settings change and may license them to organisations that build and test AI security systems. Names, email addresses, domain names, your suppliers and clients, your notes and your documents are never in them. Our commitment on de-identified data.

Your firm is included in de-identified research and licensing.

Rating, for comparison only

66 / 100 HighWas 66 at your assessment, 29 Sep

High: more than one way in is open. One of them: firm addresses are in breach data. Counting firm addresses in breach data as a way in that is open is our judgement, resting on NIST SP 800-63B on reused passwords and we never say a listed password still works. A lower rating is better. The band is decided by what was found; the number only orders firms inside a band. All eleven checks answered: forged email in your name, look-alike names, firm addresses in breach data, your website's certificate, your website's settings, files your site should not show, keys in your website's code, software versions, host names on your domain, your domain's registration and spam, malware and phishing lists. Each one with its result. The rating describes what can be read from outside your firm. It says nothing about what is inside: devices, backups, staff sign-in settings or training. How the rating works and how to tell us it is wrong. On 9 October 2026 we changed how the rating is worked out. This reading was 78 under the old method and is 66 under the new one. Nothing about your firm changed that day.

Against your sector

Your firm ranks 36 of 100 among 935 law firms we have read.

1 · least exposed100 · most exposed

1 is the least exposed and 100 the most. Each firm counts once, at its latest assessment; test, demonstration and incomplete assessments are left out. No other firm is named. Recomputed daily, last on 30 Oct 2026.

Finding	Share of law firms	Yours
Email that can be forged in the firm’s name	70% of 937	You have this
No list of allowed mail senders (SPF)	11% of 937	Clear
Firm addresses in breach databases	22% of 899	You have this
Look-alike domains registered	67% of 938	Not assessed
A service reachable that should not be	51% of 92	Not assessed

MonitorNext re-check 31 Oct

What we keep watching

Re-checked every 5 minutes: your email settings. Seen within minutes of being logged: new certificates for your domain and for look-alikes of your name. Either one changing brings an alert within minutes. New look-alike registrations are looked for every hour. Everything else is re-checked in full every day and anything new there reaches you that day.

Read again today at 22:11.

Open monitoring

Dated 30 Oct 2026

Your evidence

Your evidence pack: an owner summary, the technical evidence with the fix for every finding, a rules and insurance briefing, plus a dated assessment record · dated 30 Oct 2026

For the owners

Owner Summary and Action Brief

PDF · 7 pages

The verdict, the fixes in order and what each one closes.

Download Owner Summary and Action Brief

The evidence and the exact fix

Technical Evidence and Findings

PDF · 23 pages

Every finding with its evidence and the check that proves the fix.

Download Technical Evidence and Findings

Privacy rules and insurer questions

Rules and Insurance Briefing

PDF · 6 pages

For counsel and your insurer: your findings beside the privacy and sector rules that apply and the insurer questions an outside read can answer.

Download Rules and Insurance Briefing

Dated record, issued by LeakTrace Inc.

Assessment Record

PDF · 5 pages

A dated record of what was read from outside and found, verified by a person at LeakTrace before release. Not a certification. Outside verified by us. Inside confirmed by your team. The record holds the outside half. Your team's own checks are kept apart from it, each with its date, on your assessment page.

Download Assessment Record

The rules that apply

PIPEDA s.10.3 asks for a record of every breach of safeguards, kept 24 months. The duty applies to small businesses as well as large ones.

Source: PIPEDA; Breach of Security Safeguards Regulations

For your insurer or broker

Send proof of what you have fixed

One download with your Assessment Record, the Rules and Insurance Briefing and every fix confirmed so far, each with its date.

Assessment Record
Rules and Insurance Briefing
Fixes confirmed so far, with dates: none confirmed yet

Download the insurer pack

From the reading of 30 Oct 2026

Questions cyber insurance applications commonly ask: 7 of 11 can be shown from outside

4 need an answer from inside your firm: no outside check can see them. 1 of the 7 is marked Not confirmed: we looked and did not find it. A look from inside your firm settles it.

The outside questions cyber insurance applications commonly ask, each with its evidence. Each row is what anyone can see of your firm from outside, with the proof under it. Questions about what happens inside your firm are marked "Not visible from outside": those are answered from inside your firm. You and your broker answer the application; the insurer makes its own decision.

Answered from outside

Do you publish an SPF record listing the servers allowed to send your mail?

Partly

SPF record published.

Helps you answer: Answer Yes, the record exists. Ending it in -all makes it strict.

Is outgoing email signed with DKIM?

Not confirmed

DKIM signing couldn't be confirmed from outside (default, selector1, selector2, google, s1, s2, k1, mxvault). A key on another name is not visible from outside. Read at your assessment on 29 Sep 2026; the latest re-check did not answer.

Helps you answer: Check which selector your mail service signs with. If none, turn DKIM signing on in the mail service.

Does your domain enforce DMARC at quarantine or reject?

Not yet

DMARC is published at p=none: forged mail is reported, not refused. At your assessment (29 Sep 2026): no DMARC record is published. At the latest check: a DMARC record is published at p=none (reports only; forged mail is not refused).

Helps you answer: Answer No today. Changing the record at _dmarc.harbourview-llp.example in your DNS settings to p=quarantine, then p=reject, turns this to Yes.

Do you keep internet-facing software patched and up to date?

Not yet

The website shows PHP 8.2, older than the fixed release for its branch (8.2.35). Read at your assessment on 29 Sep 2026; the latest re-check did not answer.

Helps you answer: Answer No today. Updating PHP to 8.2.35 turns this to Yes.

Is all web traffic to your site encrypted with a valid certificate?

Partly

Valid certificate from Let's Encrypt, expires 2026-11-24. The site does not yet insist on a secure connection (no HSTS).

Helps you answer: Answer Yes; adding the HSTS header makes it complete.

Are staff email addresses clear of known breach data?

Not yet

14 firm addresses at harbourview-llp.example are present in monitored breach databases.

Helps you answer: Answer No today; resetting those passwords and turning on a second sign-in step is the fix insurers look for.

Are remote-access and database services closed to the internet?

Yes

No remote-access or database port answered from outside (2 ports checked open, none of them remote access). Read at your assessment on 29 Sep 2026; the latest re-check did not answer.

Helps you answer: Answer Yes for what faces the internet.

Not visible from outside

Do you require multi-factor sign-in for email and remote access?

Not visible from outside

Whether a second sign-in step is enforced cannot be seen from outside. We found no public sign-in page on the parts of the site we read. 14 firm addresses are present in monitored breach databases; a second step stops a leaked password being enough on its own.

Helps you answer: Confirm that each sign-in listed here requires a second step, then answer for your firm.

Do you keep offline or immutable backups and test restoring them?

Not visible from outside

Not visible from outside: no outside check can see this.

Helps you answer: Answer from inside your firm.

Is sensitive data encrypted on laptops and servers?

Not visible from outside

Not visible from outside: no outside check can see this.

Helps you answer: Answer from inside your firm.

Do you run endpoint protection (EDR) on every computer?

Not visible from outside

Not visible from outside: no outside check can see this.

Helps you answer: Answer from inside your firm.

Your walkthrough, recorded from this dashboard

A short video of this page as it stood at release: your open ways in, who does each fix, how to mark one done, your documents and what we keep watching. No sound is needed.

Recorded 27 Oct 2026 · 119 seconds · questions to [email protected]

Your email can be forged and 14 firm addresses are in breach data. Two fixes below close it.

Next: Your site is missing 6 browser protections · About 20 minutes

Start with these two

Fix 2: Reset the exposed logins and require a second sign-in step

What we watch

What changed since your assessment

14 more firm addresses appeared in monitored breach databases.

Your AI security agent

Registered domains with names close to yours

Seen this week, matched to you

Arizona court system

Open and closed, with the proof

Email

Nothing tells mail servers to refuse email forged in your nameTechnical name: No DMARC record

Firm logins

Firm addresses in breach data

Settings to tidy

Your site is missing 6 browser protectionsTechnical name: Missing security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

Your domain's address records are not signedTechnical name: DNSSEC not enabled

A public file on your site lists the addresses of its private areasTechnical name: robots.txt lists internal paths

Email on its way to you is not required to travel encryptedTechnical name: MTA-STS not enforced

You get no reports when email to you fails to arrive securelyTechnical name: TLS-RPT not set up

Your website lists the names of the accounts that can sign in to itTechnical name: WordPress user list exposed

An online storage folder with your firm's name exists, called harbourview-llp. We could not open it and cannot tell whose it is. Please say whether it is yours

Recorded for context

The system your website is built on needs its add-ons kept up to dateTechnical name: WordPress detected

Your website shares its internet address with many other sitesTechnical name: Shared IP address

A fix for the software behind your website was published on 21 October; your site shows a version from before it

Is anyone already inside? How to check

Checked and clear

Since your assessment

Inside, confirmed by your team

How often

Who gets it

Check our office connection

Your firm ranks 36 of 100 among 935 law firms we have read.

What we keep watching

Your evidence

Owner Summary and Action Brief

Technical Evidence and Findings

Rules and Insurance Briefing

Assessment Record

Send proof of what you have fixed

Questions cyber insurance applications commonly ask: 7 of 11 can be shown from outside

Answered from outside

Not visible from outside

Your walkthrough, recorded from this dashboard

Share and export

Give your auditor or underwriter access

Download the evidence package

Check the addresses your people use against breach databases