Automatic security check · Public OSINT only
Company website
developer.xero.com security check
Public OSINT valuation for developer.xero.com: grade D (53/100). Title signal “Xero Developer Platform”. 1 security headers present, 7 commonly expected headers missing. This is a defensive surface review — not a penetration test.
Elevated risk
Several weak public signals. Treat with care until ownership and security posture are confirmed. Passive OSINT only · inventKeys=false.
- High concern
- Elevated risk
- Caution advised
- Trusted — verify
- Strong protections
Company website · Services · Social
Company website
Services & products
Links are extracted from public crawl HTML only. We never invent profiles or product pages.
Research engines · Complete scan
This complete report delivers web-check-class passive modules to customers — DNS, TLS, headers, mail auth, archives, CT logs and more — researched in the spirit of Lissy93/web-check. Port scan, traceroute and Shodan stay off by policy. Run a live check on the security-check tool for the full interactive dashboard.
Connect this report to your website
Add a free badge that links visitors to this official Wordle security report. You get referral traffic and a backlink; customers can verify the dossier.
Trustpilot · Glassdoor
How we scored developer.xero.com
Positive signals
- TLS handshake OK (TLSv1.3).
- Content-Security-Policy observed.
- DNS resolves publicly (A/AAAA).
- robots.txt is publicly available.
- RDAP domain record available (xero.com).
- Final HTTP status 200 at https://developer.xero.com/.
Risk signals
- HSTS header missing on the final HTTPS response.
- X-Content-Type-Options missing.
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
Findings
- TLS handshake OK (TLSv1.3).
- HSTS header missing on the final HTTPS response.
- Content-Security-Policy observed.
- X-Content-Type-Options missing.
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
- DNS resolves publicly (A/AAAA).
- robots.txt is publicly available.
- RDAP domain record available (xero.com).
- Final HTTP status 200 at https://developer.xero.com/.
Technical details
DNS
resolved- A
- 95.100.248.31, 95.100.248.30
- AAAA
- —
- PTR
- a95-100-248-31.deploy.static.akamaitechnologies.com
- error
- —
TLS / certificate
ok- version
- TLSv1.3
- cipher
- TLS_AES_256_GCM_SHA384
- issuer
- Let's Encrypt
- notAfter
- Dec 20 21:07:47 2026 GMT
- SAN sample
- activity.xero.com, api-explorer.xero.com, apps.xero.com, ask-bot.xero.com, ask.xero.com, autax.xero.com, bankaccounts.xero.com, brand.xero.com
- error
- —
HTTP & security headers
1 present- finalUrl
- https://developer.xero.com/
- status
- 200
- server
- tpzgw-c
- x-powered-by
- —
- present
- content-security-policy
- missing
- strict-transport-security, x-content-type-options, x-frame-options, referrer-policy, permissions-policy, cross-origin-opener-policy, cross-origin-resource-policy
- cookie Secure
- True
- cookie HttpOnly
- False
Tech fingerprint (public)
passive- title
- Xero Developer Platform
- generator
- —
- tech
- React, Next.js
- script hosts
- x
- description
- Join a vibrant community of developers whose integrations with Xero are shaping the future of small businesses globally. Xero Developer: Powering Your Innovation and Growth!
Company presence (crawl links)
extracted- companyWebsite
- https://developer.xero.com/
- serviceLinks
- Check out details around the new pricing: https://developer.xero.com/faq/pricing-and-policy-updates, Developer Platform Terms and Conditions: https://developer.xero.com/xero-developer-platform-terms-conditions, The Xero Developer Platform Commercial Terms: https://developer.xero.com/xero-developer-platform-commercial-terms
- socialLinks
- GitHub: https://github.com/XeroAPI, GitHub: https://github.com/XeroAPI/xero-agent-toolkit, GitHub: https://github.com/XeroAPI/xero-mcp-server, GitHub: https://github.com/XeroAPI/xero-prompt-library, Instagram: https://www.instagram.com/xeroapi/, X (Twitter): https://twitter.com/xeroapi, YouTube: https://www.youtube.com/channel/UC7DA_vntKKChsenzpL7QWPg
RDAP / registration
rdap- domain
- xero.com
- registrar
- CSC Corporate Domains, Inc.
- created
- 1997-06-03T04:00:00Z
- expires
- 2035-06-02T04:00:00Z
- nameservers
- ns-1391.awsdns-45.org, ns-1911.awsdns-46.co.uk, ns-90.awsdns-11.com, ns-983.awsdns-58.net
- status
- client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
- error
- —
Public well-known
passive- /.well-known/security.txt
- HTTP 404
- /robots.txt
- HTTP 200 · found
- /security.txt
- HTTP 404