Full Email Security Remediation for Insurance Agency
The Incident
An insurance agency had zero email authentication, making them vulnerable to domain spoofing. They also lacked security headers on their website and had 5 exposed configuration files containing sensitive data.
What We Did
- Deployed SPF, DKIM, DMARC p=reject — full email authentication stack
- Installed security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options
- Removed and rotated credentials from all 5 exposed files and verified via rescan
Before vs After
| Security Score | 35 | 90 |
| Email Authentication | ✗ | ✓ p=reject |
| Security Headers | 0/4 | 4/4 |
| Exposed Files | 5 | 0 |
Key Takeaways
Email authentication and security headers are baseline. Without them, spoofing and clickjacking are trivial.
FAQ
What are security headers?
HTTP response headers like CSP and HSTS that tell browsers how to handle content securely — blocking XSS, clickjacking, and downgrade attacks.
Don't wait for the breach
The best time to harden was before the incident. The second best time is now.
Deploy Protection