Sign in Start free

A sample report

The same document a verified owner receives, produced by the shipped rules from a storefront we wrote ourselves.

Synthetic storefront

www.deep-synthetic.example is not a real shop. It is a storefront we authored for our own tests — every product, category, extension and defect in it was written by hand, and the hostname is under a reserved domain that resolves nowhere. We do not publish an audit of somebody else’s site as marketing, which is the same commitment the crawler page and the partner clauses make to merchants who are not our customers.

The findings, the scores and the skipped checks below are not written copy: they are what the rules in the product produce from that storefront, at a standard audit depth, rendered at the Enterprise plan so nothing is hidden behind a lock. The executive summary a language model writes is absent, because no model was called to produce this document and we do not fabricate one.

SuiteCommerce health report — www.deep-synthetic.example

Generated 2026-09-15T00:00:00.000Z

81 / 100Overall health

Host: www.deep-synthetic.example
Platform: sca
Release: 2024.1.30 (certain, modern family)
Theme: none detected
Extensions: 2
Audit depth: standard
Pages fetched: 60
Pages rendered: 20
Generated: 2026-09-15T00:00:00.000Z

SEO58 / 100

coverage 72%

Exposure80 / 100

coverage 74%

Content90 / 100

coverage 84%

Performance98 / 100

coverage 86%

Accessibility94 / 100

coverage 100%

Platform95 / 100

coverage 86%

Exposure80 / 100 · coverage 74%

Exposure findings
Severity	Confidence	Status	Finding	Affected	Source	Evidence
Error	Certain	Unknown	Plain HTTP does not redirect permanently to HTTPS1 plain-HTTP address(es) for this storefront answer without redirecting to HTTPS, so the site — and a shopper session on it — is reachable over an unencrypted connection.	site-wide—	rule	Plain HTTP does not redirect permanently to HTTPS 1 plain-HTTP address(es) for this storefront answer without redirecting to HTTPS, so the site — and a shopper session on it — is reachable over an unencrypted connection. Affected site-wide Attributed to cause not attributed Rule `security/http-not-redirected` Source rule Evidence (2) Site › hostHygiene.variants[1] — 4 fields`site:hostHygiene.variants[1]` Site › host — "www.deep-synthetic.example"`site:host` Fix Setup > SuiteCommerce Advanced > Set Up Web Site > Web Site record, the domain list and its HTTPS setting; then your DNS or CDN — a configuration change Make every hostname on this domain serve HTTPS, including the apex. Redirect http:// to https:// with a 301 at the first hop. Re-check from outside your network that no plain-HTTP address answers 200.
Warning	Certain	Unknown	The storefront can be framed by another siteThe storefront sends neither X-Frame-Options nor a CSP frame-ancestors directive, so any site can load it in a frame and overlay it.	site-wide—	rule	The storefront can be framed by another site The storefront sends neither X-Frame-Options nor a CSP frame-ancestors directive, so any site can load it in a frame and overlay it. Affected site-wide Attributed to cause not attributed Rule `security/xfo-missing` Source rule Evidence (2) Response header x-frame-options — absent`security:headers#x-frame-options` Response header content-security-policy — absent`security:headers#content-security-policy` Fix A merchant-controlled CDN or reverse proxy in front of the storefront; NetSuite sends these headers on some releases and not others — a configuration change Add Content-Security-Policy: frame-ancestors 'self' — the modern directive, which browsers prefer over X-Frame-Options. Add X-Frame-Options: SAMEORIGIN alongside it for older browsers. If a partner legitimately frames the site, name their origin in frame-ancestors rather than leaving it open.
Info	Certain	Unknown	No Content-Security-Policy is sentThe storefront sends no Content-Security-Policy. A useful one is hard here: the SSP application emits inline scripts and the templates bundle is evaluated at runtime, so a policy without unsafe-inline would break the site. This is recorded as context rather than as a defect.	site-wide—	rule	No Content-Security-Policy is sent The storefront sends no Content-Security-Policy. A useful one is hard here: the SSP application emits inline scripts and the templates bundle is evaluated at runtime, so a policy without unsafe-inline would break the site. This is recorded as context rather than as a defect. Affected site-wide Attributed to cause not attributed Rule `security/csp-missing` Source rule Evidence (1) Response header content-security-policy — absent`security:headers#content-security-policy` Fix A merchant-controlled CDN or reverse proxy in front of the storefront; NetSuite sends no CSP of its own — a configuration change Start in report-only mode and collect violations for a week before enforcing anything. Begin with the directives that cost nothing on SuiteCommerce: frame-ancestors, object-src none, base-uri self. Treat script-src as a separate project: it needs every inline block the SSP application and the generator emit to be accounted for first.
Info	Certain	Unknown	Platform: The NetSuite account id is reachable from the storefrontThe account id is reachable from the storefront: the CMS domain API names the NetSuite system domain, which carries it. This is NetSuite behaviour and there is no setting that suppresses it.	site-wide—	rule	Platform: The NetSuite account id is reachable from the storefront The account id is reachable from the storefront: the CMS domain API names the NetSuite system domain, which carries it. This is NetSuite behaviour and there is no setting that suppresses it. Affected site-wide Attributed to NetSuite platform Rule `exposure/system-domain` Source rule Evidence (2) Discovery › siteDomain.systemDomain — "https://1000001.app.netsuite.com/"`discovery:siteDomain.systemDomain` Site › companyId — "1000001"`site:companyId` Fix Nothing on the Web Site record changes this; the endpoint is a platform API — a configuration change Treat the account id as public when deciding what else may be keyed on it.
Info	Likely	Unknown	The public items API returns internal item fieldsThe public items API returns 2 operational field(s) for every item: isinactive, isonline. No commercial or cost field is exposed; confirm each of these is one you mean to publish.	2 configuration keys—	rule	The public items API returns internal item fields The public items API returns 2 operational field(s) for every item: isinactive, isonline. No commercial or cost field is exposed; confirm each of these is one you mean to publish. Affected 2 configuration keys Attributed to cause not attributed Rule `exposure/item-fields-internal` Source rule Evidence (2) Catalog › internalLookingFields[0] — "isinactive"`catalog:internalLookingFields[0]` Catalog › internalLookingFields[1] — "isonline"`catalog:internalLookingFields[1]` Fix Setup > SuiteCommerce Advanced > Set Up Web Site > Web Site record, the Search and Item Details fieldsets; field names come from Configuration > ItemsSearchAPI — a configuration change Remove from the fieldset every field the storefront does not render — the API returns the whole fieldset to anonymous callers. Where a price level is genuinely needed for logged-in shoppers, rely on the personalised items endpoint rather than publishing it in the anonymous fieldset. Re-crawl and confirm the field is gone from the items response.
Info	Certain	Unknown	No Referrer-Policy is declaredThe storefront declares no Referrer-Policy, so the browser default decides what is sent with every cross-origin request. Storefront URLs carry search terms, facet paths and session tokens.	site-wide—	rule	No Referrer-Policy is declared The storefront declares no Referrer-Policy, so the browser default decides what is sent with every cross-origin request. Storefront URLs carry search terms, facet paths and session tokens. Affected site-wide Attributed to cause not attributed Rule `security/referrer-policy-missing` Source rule Evidence (1) Response header referrer-policy — absent`security:headers#referrer-policy` Fix A merchant-controlled CDN or reverse proxy in front of the storefront; NetSuite sends no Referrer-Policy — a configuration change Send Referrer-Policy: strict-origin-when-cross-origin to make the current browser default explicit. Tighten to origin-when-cross-origin if any analytics vendor should not receive shopper search terms or facet paths. Check that nothing you rely on needs the full referrer before tightening further.
Info	Certain	Unknown	Platform: No Strict-Transport-Security header is sentThe storefront sends no Strict-Transport-Security header, so a shopper who types the domain makes one interceptable plain-HTTP request before being redirected. NetSuite does not emit this header and no Web Site setting adds it.	site-wide—	rule	Platform: No Strict-Transport-Security header is sent The storefront sends no Strict-Transport-Security header, so a shopper who types the domain makes one interceptable plain-HTTP request before being redirected. NetSuite does not emit this header and no Web Site setting adds it. Affected site-wide Attributed to NetSuite platform Rule `security/hsts-missing` Source rule Evidence (1) Response header strict-transport-security — absent`security:headers#strict-transport-security` Fix Nothing on the Web Site record adds this header; NetSuite does not emit it — a configuration change Put a merchant-controlled CDN in front of the storefront if this matters to your risk assessment; that is the only place the header can be added. Make sure the plain-HTTP redirect to HTTPS is in place, which is what limits the exposure to a single request.

Want this for your own storefront? See the plans, or verify a domain and take the free audit.