888AI Trusted Reviews · Public OSINT security valuation
xero.com
Public OSINT valuation for xero.com: grade C (59/100). Title signal “Accounting Software for Small Businesses | Xero”. 2 security headers present, 6 commonly expected headers missing. This is a defensive surface review — not a penetration test.
59
C
Findings
- TLS handshake OK (TLSv1.3).
- HSTS header missing on the final HTTPS response.
- Content-Security-Policy not observed.
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
- DNS resolves publicly (A/AAAA).
- robots.txt is publicly available.
- RDAP domain record available (xero.com).
- Final HTTP status 200 at https://www.xero.com:443/.
Checks
DNS
resolved- A
- 3.174.46.104, 3.174.46.78, 3.174.46.85, 3.174.46.60
- AAAA
- —
- PTR
- server-3-174-46-104.fra60.r.cloudfront.net
- error
- —
TLS / certificate
ok- version
- TLSv1.3
- cipher
- TLS_AES_128_GCM_SHA256
- issuer
- Amazon
- notAfter
- Feb 16 23:59:59 2027 GMT
- SAN sample
- *.xero.com, xero.com
- error
- —
HTTP & security headers
2 present- finalUrl
- https://www.xero.com:443/
- status
- 200
- server
- AmazonS3
- x-powered-by
- —
- present
- x-content-type-options, x-frame-options
- missing
- strict-transport-security, content-security-policy, referrer-policy, permissions-policy, cross-origin-opener-policy, cross-origin-resource-policy
- cookie Secure
- True
- cookie HttpOnly
- False
Tech fingerprint (public)
passive- title
- Accounting Software for Small Businesses | Xero
- generator
- —
- tech
- Next.js
- script hosts
- www.xero.com, cdn-au.onetrust.com, x
- description
- Xero software for small businesses connects you to your bank, accountant, bookkeeper, and other business apps. Start a free trial today.
RDAP / registration
rdap- domain
- xero.com
- registrar
- CSC Corporate Domains, Inc.
- created
- 1997-06-03T04:00:00Z
- expires
- 2035-06-02T04:00:00Z
- nameservers
- ns-1391.awsdns-45.org, ns-1911.awsdns-46.co.uk, ns-90.awsdns-11.com, ns-983.awsdns-58.net
- status
- client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
- error
- —
Public well-known
passive- /.well-known/security.txt
- HTTP 403
- /robots.txt
- HTTP 200 · found
- /security.txt
- HTTP 404
Reviews from Trustpilot
Official Trustpilot profile for this domain (public page — we do not scrape Trustpilot).
Open Trustpilot for xero.comScores/widgets require SECSCAN_TRUSTPILOT_API_KEY on scan.888ai.org · inventKeys=false
888AI Trusted Reviews are brought to You by DOT Synergy llc, the worlds leader in Trusted Reviews.