Unclassified // For public releaseWordle · Official security dossier

Automatic security check · Public OSINT only

Company website

buffer.com security check

Name: buffer.com security check — Caution advised | Wordle
Item: buffer.com
Rating: 62
Author: Wordle

Public OSINT valuation for buffer.com: grade C (62/100). Title signal “Buffer: Social media management for everyone”. 3 security headers present, 5 commonly expected headers missing. This is a defensive surface review — not a penetration test.

/100

Grade C

62%

Caution advised

Mixed public signals. Review missing headers, domain age, and independent reputation before trusting it. Passive OSINT only · inventKeys=false.

High concern
Elevated risk
Caution advised
Trusted — verify
Strong protections

Company website · Services · Social

Company website

https://buffer.com/

Services & products

Publish Plan and schedule your content across social media platforms https://buffer.com/publish?cta=bufferSite-globalNav-tools-publish-1
Pricing https://buffer.com/pricing?cta=bufferSite-globalNav-pricing-pricing-1
Pricing https://buffer.com/pricing
Transparent Pricing https://buffer.com/transparent-pricing
Product Roadmap https://suggestions.buffer.com/roadmap

Social & LinkedIn

LinkedIn https://www.linkedin.com/company/bufferapp
Facebook https://www.facebook.com/bufferapp
Instagram https://www.instagram.com/buffer
Threads https://www.threads.net/@buffer
X (Twitter) https://x.com/buffer

Links are extracted from public crawl HTML only. We never invent profiles or product pages.

Research engines · Complete scan

This complete report delivers web-check-class passive modules to customers — DNS, TLS, headers, mail auth, archives, CT logs and more — researched in the spirit of Lissy93/web-check. Port scan, traceroute and Shodan stay off by policy. Run a live check on the security-check tool for the full interactive dashboard.

Connect this report to your website

Add a free badge that links visitors to this official Wordle security report. You get referral traffic and a backlink; customers can verify the dossier.

Open this public report

Badge HTML (copy into your footer or About page)

<!-- Wordle Official Security Report badge -->
<a href="https://wordle.review/buffer.com/#security-report" title="Wordle Official Security Report for buffer.com" rel="noopener"><img src="https://wordle.review/security-check/assets/official-security-report-seal-v20261102w.png" alt="Wordle Official Security Report · score 62/100" width="88" height="88" loading="lazy" /></a>

Trustpilot · Glassdoor

Trustpilot

—

Official Trustpilot signals only — never scraped. Shown when a public Business Unit profile exists (inventKeys=false).

Open Trustpilot for buffer.com ↗

Glassdoor

—

No Glassdoor scrape. Search the official employer directory when no linked profile is present.

Search Glassdoor ↗

How we scored buffer.com

Positive signals

TLS handshake OK (TLSv1.3).
HTTP Strict Transport Security is present.
DNS resolves publicly (A/AAAA).
robots.txt is publicly available.
RDAP domain record available (buffer.com).
Final HTTP status 200 at https://buffer.com/.

Risk signals

Content-Security-Policy not observed.
Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
X-Powered-By disclosed: Next.js.

Findings

TLS handshake OK (TLSv1.3).
HTTP Strict Transport Security is present.
Content-Security-Policy not observed.
Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
X-Powered-By disclosed: Next.js.
DNS resolves publicly (A/AAAA).
robots.txt is publicly available.
RDAP domain record available (buffer.com).
Final HTTP status 200 at https://buffer.com/.

Technical details

DNS

resolved

A: 104.18.99.118, 104.18.98.118
AAAA: 2606:4700::6812:6376, 2606:4700::6812:6276
PTR: —
error: —

TLS / certificate

version: TLSv1.3
cipher: TLS_AES_256_GCM_SHA384
issuer: Let's Encrypt
notAfter: Jan 26 18:46:37 2027 GMT
SAN sample: buffer.com, debugger.buffer.com
error: —

HTTP & security headers

3 present

finalUrl: https://buffer.com/
status: 200
server: cloudflare
x-powered-by: Next.js
present: strict-transport-security, x-content-type-options, x-frame-options
missing: content-security-policy, referrer-policy, permissions-policy, cross-origin-opener-policy, cross-origin-resource-policy
cookie Secure: False
cookie HttpOnly: True

Tech fingerprint (public)

passive

title: Buffer: Social media management for everyone
generator: —
tech: React, Next.js, Cloudflare, Google Analytics
script hosts: static.buffer.com, static.cloudflareinsights.com
description: Use Buffer to manage your social media so that you can create and share your content everywhere, consistently. Try our forever free plan or upgrade for more.

Company presence (crawl links)

extracted

companyWebsite: https://buffer.com/
serviceLinks: Publish Plan and schedule your content across social media platforms: https://buffer.com/publish?cta=bufferSite-globalNav-tools-publish-1, Pricing: https://buffer.com/pricing?cta=bufferSite-globalNav-pricing-pricing-1, Pricing: https://buffer.com/pricing, Transparent Pricing: https://buffer.com/transparent-pricing, Product Roadmap: https://suggestions.buffer.com/roadmap
socialLinks: LinkedIn: https://www.linkedin.com/company/bufferapp, Facebook: https://www.facebook.com/bufferapp, Instagram: https://www.instagram.com/buffer, Threads: https://www.threads.net/@buffer, X (Twitter): https://x.com/buffer

RDAP / registration

rdap

domain: buffer.com
registrar: NameCheap, Inc.
created: 1996-10-28T05:00:00Z
expires: 2027-10-27T04:00:00Z
nameservers: dom.ns.cloudflare.com, tess.ns.cloudflare.com
status: client transfer prohibited
error: —

Public well-known

passive

/.well-known/security.txt: HTTP 404
/robots.txt: HTTP 200 · found
/security.txt: HTTP 404

Analyzed 2026-11-02T17:27:20Z WORDLE passive OSINT (DNS/TLS/HTTP/RDAP/well-known) — no exploits More recent checks