LumoAuth | Tech Stack & Analysis

What we found

It sends none of the six security headers we check.
DMARC only monitors (p=none), so email spoofing this domain is still delivered.
Built with WordPress and PHP, the site is hosted on DreamHost, with a domain registered 10 months before launch.
Only one other launch we've crawled runs this exact stack.

Built with: 16 technologies

Embed this on your site

For light pages

<a href="https://firstsited.com/launch/d8s3te6v/lumoauth"><img src="https://firstsited.com/badge/d8s3te6v/stack.svg" alt="LumoAuth tech stack on FirstSited" height="28"></a>

For dark pages

<a href="https://firstsited.com/launch/d8s3te6v/lumoauth"><img src="https://firstsited.com/badge/d8s3te6v/stack.svg?theme=dark" alt="LumoAuth tech stack on FirstSited" height="28"></a>

How it fits together

Each technology runs on, or extends, the one it sits under.

PHP Programming language
- WordPress CMS
  - WPConsent WordPress plugin

Technology	Type
Infrastructure
DreamHost	Hosting
Apache	Server
Email
DreamHost Email	Business email
MailChannels	Transactional email
Resend	Transactional email
Build & Framework
WordPress (3)	CMS
Tailwind CSS	CSS framework
Google Fonts	Font
PHP	Programming language
WPConsent	WordPress plugin
Yoast	WordPress plugin
Analytics & Marketing
Google Analytics (3)	Analytics
Microsoft Clarity (2)	Analytics
Google	Consent
Google Search Console	SEO
Google Tag Manager (2)	Tag management

Each technology links to its own page: which other new sites launched with it.

Site checks

Page basicsHow we check
	Custom title and meta description missing meta description
	Open Graph tags (title, image, description) missing og:image, og:description
	Twitter card meta tags
	Canonical URL declared
	Responsive viewport meta tag
	Favicon present
	Semantic HTML (nav, main, article)
	Localhost / private-network references -10 points. Site references http://localhost or private-network URLs (e.g. 192.168.x.x) in asset tags. These will fail to load for public visitors.

Security headersHow we check
	Referrer-Policy
	X-Frame-Options
	Permissions-Policy experimental
	X-Content-Type-Options
	Content-Security-Policy
	Strict-Transport-Security
	X-XSS-Protection deprecated, not counted

Legal pages
	Privacy policy /legal/privacy-policy/
	Terms of service /legal/terms-of-service/
	Consent manager Google

Mentions: GDPR, CCPA, Cookies, DPO, Do Not Sell, Updated: April 27, 2026

Crawl files
	robots.txt
	sitemap.xml 3 URLs
	security.txt optional
	llms.txt
	ads.txt only for ad-funded sites
	humans.txt optional

AI crawlers WelcomedHow we check
	llms.txt published
	No AI bots blocked in robots.txt
	Content-Signal none declared
	Link headers none advertised

Email

Record	Status	What it does
SPF -all	Strict (-all)	Lists the servers allowed to send email for the domain.
DMARC p=none	Monitoring only (p=none)	Tells receivers what to do with email that fails SPF or DKIM.
DKIM	Found	Signs outgoing email. We check common selectors only, so a provider may use another.
MTA-STS	Not deployed	Stops email to the domain being downgraded to plain text in transit.
TLS-RPT	Not configured	Sends the owner reports of failed encrypted deliveries.

Hosting and network

Network	DREAMHOST-AS - New Dream Network, LLC, US AS26347, US
DNSSEC	Not enabled DNS answers are unsigned
Certificate	Let's Encrypt valid 6 Oct 2026 to 4 Jan 2027, as captured
Domain age	10 months registered Dec 2025, eNom, Inc.
Green hosting	No record per The Green Web Foundation
Page build	5 JS files, 2 CSS files 6 third-party domains, code splitting
Brand colours

Storage: 0 items

Nothing stored in the browser on page load.

Performance

Measure	This site	Reading
Server response	668 ms	fair, faster than 19% of sites
Largest contentful paint	2,036 ms	good
Layout shift	0.35	a lot
Page weight	1.2 MB	fair
Image weight	448 KB	light
Images	15	8 larger than shown, 10 without width and height
Third-party domains	6
Console errors	0	none
Failed requests	0	none

From a single automated render of the home page. A quick guide, not a substitute for Lighthouse or field data. How we measure

Notes

Looks AI-built: few AI signals. How much the site looks AI-generated. It is a pattern match shown for interest, not a verdict.

Which signals fired

Signal	Points
AI copy signals	+5
AI palette signals	+5
AI writing signals	+5

Performance comes from one render on 10 November 2026 and will vary between visits.

How we know

FirstSited records what new websites are built with, usually within a day of going live. Most we find ourselves, by watching public internet infrastructure for brand-new sites; the rest come from Product Hunt, Hacker News and PeerPush. We checked this one in full: its tech stack, DNS, security headers and page basics. This page is what we saw on 10 November 2026; the live site may have changed since.

Every technology below links to its own page: which other new sites launched with it. Watch any of them and get every new site that uses it as it goes live, from £15 a month.