Skip to main content

Is neh.gov a Scam? Security Check Results - National Endowment for the Humanities Reviews

neh.gov favicon

Is neh.gov Safe? Security Analysis for National Endowment for the Humanities

Check if neh.gov is a scam or legitimate. Free security scan and reviews.

GovernmentUnited Stateslarge
Drupal 10Google Tag ManagerGoogle AnalyticsSelect2jQuery+2 more
Analyzed 9/5/2025Completed 4:45:47 PM
67
Security Score
MEDIUM RISK

AI Summary

The National Endowment for the Humanities (NEH) is a large, independent federal agency dedicated to supporting humanities research, education, and public programming across the United States. Established in 1965, NEH has a strong market position as the largest public funder of humanities projects, providing over $6 billion in grants to a wide range of cultural and educational institutions. The website reflects a professional and authoritative presence consistent with a government entity, targeting scholars, educators, cultural organizations, and the general public interested in humanities initiatives. Technically, the website is built on Drupal 10, leveraging modern web technologies such as Google Tag Manager, YouTube APIs, and accessibility features. The site demonstrates good performance and mobile optimization, with a clear navigation structure and comprehensive content. Security posture is strong with HTTPS enforcement and content security policies, though there is room for improvement in cookie consent mechanisms and publishing incident response contacts. From a security and compliance perspective, the site maintains privacy and vulnerability disclosure policies, but lacks explicit cookie consent and a security.txt file. WHOIS data is unavailable, which is typical for .gov domains, but this does not detract from the site's legitimacy given its official status and consistent branding. Overall, NEH's website is a trustworthy, well-maintained government resource with excellent content quality and a solid technical foundation. Strategic recommendations include enhancing privacy compliance with cookie consent, publishing incident response contacts, and adding a security.txt file to further improve security transparency.

Detected Technologies

Drupal 10Google Tag ManagerGoogle AnalyticsSelect2jQueryYouTube iframe APIModernizr

🧠AI Business Intelligence

Technology stack, business insights, and market analysis powered by AI.

Business Intelligence

Market & Strategic Analysis

NEH operates as a government funding agency with a focus on humanities sectors including history, literature, philosophy, and cultural studies. Its business model centers on grantmaking and supporting public humanities projects nationwide. The agency's competitive advantage lies in its federal backing and extensive funding history. The target audience includes academic institutions, cultural organizations, educators, and researchers. The website's partnership ecosystem includes related government projects such as Edsitement! and Chronicling America. Growth indicators include ongoing funding announcements and initiatives like the 250th Anniversary projects. NEH maintains a strong market presence as a key federal humanities supporter with a clear mission and broad outreach.

Security Posture Analysis

Comprehensive Security Assessment

The website demonstrates a mature security posture with HTTPS enforced and use of Content Security Policy nonces to mitigate script injection risks. No exposed sensitive data or vulnerable libraries were detected in the HTML content. However, the absence of a cookie consent mechanism and security.txt file indicates areas for improvement in privacy compliance and vulnerability disclosure transparency. Incident response contact information is not publicly available, which could hinder rapid communication in case of security events. Overall, the site aligns well with government security standards but could enhance user privacy and incident handling visibility.

Strategic Recommendations

Priority Actions for Security Improvement

1

Implement a clear cookie consent banner or mechanism to comply with privacy regulations and improve user transparency.

Observations

AI-powered comprehensive website and business analysis.

AI-Enhanced Website Analysis

Business Insights

Company:

National Endowment for the Humanities

Description:

NEH is an independent federal agency that supports the humanities in every state and U.S. jurisdiction. Since 1965, NEH has awarded over $6 billion to support museums, historic sites, universities, teachers, libraries, documentary filmmakers, public TV and radio stations, research institutions, scholars, and local humanities programming.

Key Services:
Grant programsFunding opportunitiesPublic humanities programmingResearch support
Content Quality:

excellent

Branding:

consistent

Technical Stack

Technologies:
Drupal 10Google Tag ManagerGoogle AnalyticsSelect2jQueryYouTube iframe APIModernizr
Frameworks:
Drupal
Performance:

moderate

Mobile:

excellent

Accessibility:

good

SEO:

good

Security Assessment

Security Score:
85/100
Best Practices:
  • HTTPS enforced
  • Content Security Policy nonce used
  • No exposed sensitive data in HTML
  • Use of Google Tag Manager with consent mode disabled

Analytics & Tracking

Services:
Google AnalyticsGoogle Tag Manager
Tracking Level:moderate
Privacy Compliance:basic

Advertising & Marketing

Transparency Level:basic

Website Quality Assessment

Design Quality:excellent
User Experience:excellent
Content Relevance:excellent
Navigation Clarity:excellent
Professionalism:excellent
Trustworthiness:high

Key Observations

1

Official US government website with .gov domain

🛡️Security Headers

HTTP security headers analysis and recommendations.

Security Headers

HTTP security headers analysis

75/100
Score

Weak X-XSS-Protection configuration

LOW

Current value: "1"

Missing Referrer-Policy header

LOW

Controls referrer information sent with requests

Missing Permissions-Policy header

MEDIUM

Controls browser features and APIs

Sensitive data may be cached

LOW

Cache-Control header should include "no-store" for sensitive pages

👤GDPR Compliance

Privacy and data protection assessment under GDPR regulations.

GDPR Compliance

Privacy and data protection assessment

53/100
Score

No Cookie Policy found

HIGH

GDPR requires clear information about cookie usage

No Cookie Consent Banner found

HIGH

GDPR requires explicit consent for non-essential cookies

No Data Protection Officer mentioned

LOW

Large organizations may need to designate a DPO under GDPR

Privacy policy may not be GDPR compliant

MEDIUM

Privacy policy lacks explicit GDPR compliance elements

GDPR Compliance Analysis

Privacy Policy85% confidence
Cookie Policy0% confidence
Contact Information Found90% confidence
phone

🛡️NIS2 Compliance

Network & Information Security Directive compliance assessment.

NIS2 Compliance

Network & Information Security Directive

35/100
Score

No information security framework found

HIGH

NIS2 requires documented cybersecurity and information security measures

No security policy documentation found

HIGH

NIS2 requires documented cybersecurity governance and risk management

No incident response procedures found

HIGH

NIS2 requires documented incident response and business continuity plans

No business continuity planning found

MEDIUM

NIS2 emphasizes operational resilience and business continuity

No security contact information

HIGH

NIS2 requires clear incident reporting channels

No NIS2 reference found

LOW

Consider explicitly mentioning NIS2 compliance efforts

📧Email Security

SPF, DKIM, and DMARC validation and email security assessment.

Email Security

SPF, DKIM, and DMARC validation

85/100
Score

No BIMI Record

LOW

BIMI displays brand logos in email clients

No MTA-STS Policy

MEDIUM

MTA-STS enforces TLS for email delivery

No TLS-RPT Record

LOW

TLS-RPT provides reporting for email TLS issues

SPF
Sender Policy Framework
DKIM
DomainKeys Identified Mail
DMARC
Domain-based Message Authentication
MX Records
Mail Exchange Records
BIMI
Brand Indicators
MTA-STS
Mail Transfer Agent Security
TLS-RPT
TLS Reporting
DNSSEC
DNS Security
SPF Details
Record:
v=spf1 ip4:65.114.144.66 ip4:65.114.144.90 ip4:65.196.123.228 ip4:65.196.123.227 ip4:65.196.123.226 ip4:65.196.123.225 ip4:52.222.69.242 ip4:52.222.68.204 ip4:96.127.113.23 ip4:149.72.129.240 include:spf.congressplus.com include:spf.protection.outlook. com include:mail.zendesk.com -all
DNS Lookups:3/10
Policy:-all
DKIM Selectors Found
Selector:selector2(1296-bit rsa)
Selector:s1(1440-bit rsa)
DMARC Details
Policy:reject
Aggregate Reports:oirm@neh.gov

🏆SSL/TLS Security

Certificate validity and encryption analysis.

SSL/TLS Security

Certificate validity and encryption analysis

72/100
Score

Weak Protocols Supported

HIGH

Server supports weak protocols: TLSv1.1

OCSP Stapling Not Enabled

LOW

OCSP stapling improves performance and privacy

Certificate Transparency Not Implemented

LOW

Certificate is not logged in Certificate Transparency logs

SSL Certificate Expires Within 90 Days

MEDIUM

SSL certificate expires in 77 days

Partial SSL/TLS Assessment

LOW

Completed 3 of 4 security checks due to time constraints

Protocol Support

TLSv1.3TLSv1.2TLSv1.1

OCSP Status

OCSP Stapling Disabled

📊DNS Health

DNS configuration and security assessment.

DNS Health

DNS configuration and security assessment

30/100
Score

DNSSEC Not Enabled

MEDIUM

DNSSEC is not configured for this domain

CAA Records Not Configured

LOW

Certificate Authority Authorization (CAA) records not found

Domain Expired

CRITICAL

Domain expired 7 days ago

Domain Delete Lock Not Enabled

LOW

Domain can be deleted without additional verification

Domain Registration Details

Domain Age
27 years(mature)
Expiry Risk
expired(expired)
Protection Level
basicDNSSEC OFF
Suspicious Indicators Detected
  • Domain expired 7 days ago
  • Privacy/proxy registration detected

DNS Records

A Records:23.21.228.79
Name Servers:
sauthns1.qwest.net
sauthns2.qwest.net
MX Records:
0: neh-gov.mail.protection.outlook.com
SOA:Serial: 2250610138, TTL: 300s

DNSSEC Status

DNSSEC Not Enabled

DNS Performance

Resolution Time:160ms

SPF Analysis

SPF Record:
v=spf1 ip4:65.114.144.66 ip4:65.114.144.90 ip4:65.196.123.228 ip4:65.196.123.227 ip4:65.196.123.226 ip4:65.196.123.225 ip4:52.222.69.242 ip4:52.222.68.204 ip4:96.127.113.23 ip4:149.72.129.240 include:spf.congressplus.com include:spf.protection.outlook. com include:mail.zendesk.com -all

Network Security

Port scanning and network exposure analysis.

Network Security

Port scanning and network exposure analysis

100/100
Score

Good Network Security Posture

LOW

No unnecessary services detected on common risky ports

🔧Technical Analysis

Detailed technical findings and analysis from AI assessment.

Technical Analysis

Comprehensive security assessment findings

Additional Findings

The website is built on Drupal 10 CMS, utilizing modern JavaScript libraries such as jQuery, Select2, and Google Tag Manager for analytics and event tracking. The site uses responsive design with Google Fonts and supports accessibility features. Performance is moderate with multiple CSS and JS assets loaded, but optimized image usage and lazy loading are present. The hosting provider is not explicitly identified, but the site uses HTTPS with strong SSL configuration. The technical stack is modern and well-maintained, though opportunities exist to streamline third-party dependencies and improve cookie management for privacy compliance.
Analyze Another Website