98 Security Checks
Comprehensive security scanning across TLS, headers, DNS, secrets, attack surface, and supply chain. All 98 checks included on every scan.
Headers Security
18 checksHTTP security headers protect against XSS, clickjacking, MIME sniffing, and browser-based vulnerabilities.
Content Security Policy (CSP)
Restricts sources from which scripts, styles, and assets can load to prevent XSS and code injection.
HSTS Enabled (Strict-Transport-Security)
Tells browsers to only access your site over HTTPS, preventing protocol downgrade attacks.
HSTS Preload Eligibility
Verifies if your HSTS configuration meets Chromium preload requirements (max-age ≥ 1 year, subdomains, preload).
Frame Security Policy (X-Frame-Options)
Controls whether your page can be embedded in iframes on other sites, protecting against clickjacking.
X-Content-Type-Options Header
Prevents browsers from MIME-sniffing a response away from the declared content-type, stopping script execution from uploads.
Permissions-Policy Header
Controls which browser features (camera, microphone, geolocation, payment) can be used on your page and in iframes.
Referrer-Policy Header
Governs how much referrer information (including URLs and sensitive query parameters) is sent when navigating away.
Set-Cookie Headers (Secure, HttpOnly, SameSite)
Cookie security attributes (Secure, HttpOnly, SameSite) protect session cookies from theft and cross-site attacks.
Cookie Prefix Hardening (__Host- and __Secure-)
Validates that sensitive authentication tokens leverage browser cookie prefixes (__Host- or __Secure-) to prevent cookie tossing.
CORS Misconfiguration & Wildcard Audit
Detects overly permissive Access-Control-Allow-Origin headers or null origins that expose authenticated APIs to cross-origin attackers.
Cross-Origin Resource Isolation (COOP, COEP, CORP)
Evaluates COOP (Cross-Origin-Opener-Policy) and COEP headers to isolate your browsing context from Spectre-like side-channel attacks.
Server Information Disclosure
Checks if Server or X-Powered-By headers reveal software versions (e.g. Apache/2.4.41, PHP/7.4.3), aiding attacker reconnaissance.
X-Powered-By Header Stripping
Ensures frameworks like Express, Next.js, or PHP do not emit X-Powered-By fingerprint headers in responses.
Cache-Control for Sensitive Endpoints
Ensures authenticated and sensitive endpoints return Cache-Control: no-store to prevent caching on shared proxy servers.
Deprecated X-XSS-Protection Header
Checks that legacy X-XSS-Protection is set to 0 or removed to prevent browser XSS auditor vulnerabilities.
Reporting-Endpoints & NEL Header
Inspects Reporting-Endpoints and Network Error Logging (NEL) headers for automated real-time security violation reporting.
Content-Type Header & Charset Declaration
Ensures all HTML/API responses specify an explicit Content-Type with charset=utf-8 to prevent UTF-7 encoding bypasses.
Trusted Types Readiness (DOM XSS Protection)
Evaluates CSP require-trusted-types-for directive to prevent DOM-based XSS by enforcing typed objects.
SSL/TLS & Transport
12 checksCryptographic security, cipher strengths, certificate health, and protocol downgrade mitigation.
HTTPS Enforced (301 Redirect)
Ensures the root domain and all HTTP traffic permanently redirects (301) to an encrypted HTTPS connection.
Modern TLS Version (TLS 1.2+ / TLS 1.3)
Ensures support for TLS 1.2 and modern TLS 1.3 protocols while disabling insecure legacy standards (TLS 1.0, 1.1, SSLv3).
SSL Certificate Expiry Monitoring
Tracks certificate expiration dates and triggers alerts before certificates lapse, avoiding browser security warnings.
Self-Signed Certificate Detection
Verifies the certificate is issued by a globally trusted Certificate Authority (CA) rather than self-signed.
SSL Certificate Chain Validation
Checks whether intermediate certificates are properly bundled so mobile and legacy clients can verify trust.
Cryptographic Key Strength (RSA 2048+ / ECC)
Checks public key modulus size (RSA ≥ 2048-bit, ECC ≥ 256-bit) to withstand brute-force cryptanalysis.
OCSP Stapling (Certificate Revocation)
Checks if the web server pre-fetches and caches SSL revocation status to optimize connection speed and user privacy.
Certificate Transparency (CT) Logs
Queries crt.sh to verify that all active certificates are logged publicly to detect unauthorized issuance.
Mixed Content Detection (HTTP in HTTPS)
Scans for insecure http:// script, image, stylesheet, and iframe embeds loaded on an HTTPS page.
HTTP/2 & ALPN Protocol Negotiation
Verifies the server supports HTTP/2 protocol via ALPN negotiation for multiplexed, secure connections.
Insecure Cipher Suite Audit
Audits server cipher suites to ensure insecure algorithms (RC4, 3DES, CBC, MD5) are disabled.
Perfect Forward Secrecy (PFS)
Ensures TLS handshakes negotiate ECDHE or DHE key exchanges so compromised private keys cannot decrypt recorded past traffic.
DNS & Email Trust
13 checksEmail spoofing defense, DNSSEC validation, CAA authority, and domain routing trust.
SPF Record Validation
Validates that your domain publishes an active Sender Policy Framework (SPF) record to authorize legitimate outbound mail servers.
SPF Policy Enforcement Strength
Evaluates the terminal qualifier of your SPF record (-all hardfail vs ~all softfail vs +all).
DMARC Record Validation
Ensures a _dmarc TXT record exists to coordinate SPF and DKIM authentication results.
DMARC Enforcement Policy (p=reject / p=quarantine)
Checks whether DMARC policy is set to enforce (p=reject or p=quarantine) rather than passive monitoring (p=none).
DKIM (DomainKeys Identified Mail) Selectors
Checks for cryptographic DKIM public keys used to digitally sign outbound emails and prevent tampering in transit.
DNSSEC Validation & Signatures
Validates Domain Name System Security Extensions (DNSSEC) to prevent DNS spoofing and cache poisoning attacks.
CAA (Certificate Authority Authorization) Records
Checks DNS CAA records that whitelist which Certificate Authorities (e.g. Let’s Encrypt, DigiCert) are allowed to issue certificates.
MTA-STS Policy (Mail Strict Transport)
Validates RFC 8461 MTA Strict Transport Security policy to enforce TLS encryption for incoming SMTP mail delivery.
SMTP TLS Reporting (TLS-RPT)
Checks for _smtp._tls TXT records (RFC 8460) to receive automated notifications regarding email delivery TLS failures.
BIMI (Brand Indicators for Message Identification)
Checks for default._bimi TXT records to display verified brand logos in supporting email clients (Gmail, Apple Mail).
Open DNS Resolver Vulnerability
Verifies authoritative nameservers do not permit recursive lookups for external IPs, preventing DNS amplification DDoS attacks.
Mail Server (MX) Security Records
Inspects MX records to ensure valid mail routing configuration and detect dormant or dangling mail server pointers.
Reverse DNS / PTR Record Verification
Checks whether outbound web and mail server IP addresses have matching Forward-Confirmed Reverse DNS (FCrDNS) pointers.
Secrets & Exposure
12 checksDetection of leaked API keys, tokens, environment configs, database dumps, and source maps.
Exposed API Keys & Credentials
Scans JavaScript bundles and responses for leaked API keys (OpenAI, Stripe, AWS, SendGrid, GitHub).
Extended Secret Patterns & High-Entropy Strings
Uses Shannon entropy calculations to uncover hidden RSA private keys, JWT secrets, and bearer tokens in public assets.
Sensitive Files (.env, .git, .env.local)
Probes for accidentally published configuration files (/.env, /.git/config, /docker-compose.yml, /settings.py).
Version Control Exposure (.git, .svn, .hg)
Tests for exposed /.git/HEAD, /.svn/entries, and repository metadata allowing complete source code reconstruction.
Backup & Database Dump Detection (.sql, .bak, .zip)
Searches for un-restricted backup files (backup.sql, dump.tar.gz, site.zip, database.bak) left in web directories.
Public Source Map (.js.map) Exposure
Detects public .js.map files that reveal un-minified TypeScript/JavaScript source code and internal business logic.
Cloud Credentials Exposure (.aws, gcp-key.json)
Checks for leaked cloud provider credential files (/.aws/credentials, /gcloud/credentials.db, /kube/config).
Exposed Debug Endpoints (/debug, /actuator, /telescope)
Identifies publicly accessible diagnostic and profiling routes (Spring Boot /actuator/env, Laravel /telescope, Django /__debug__).
Admin Panel Exposure (/admin, /cpanel, /wp-admin)
Scans for publicly discoverable administrative login interfaces that lack IP whitelisting or second-factor gates.
Directory Listing Enabled
Verifies that web servers do not automatically index folder contents when no default index.html is present.
robots.txt Sensitive Path Exposure
Audits robots.txt to ensure Disallow: directives do not inadvertently advertise secret administrative or staging URLs.
Sitemap Sensitive Path Exposure
Scans XML sitemaps to verify they do not include internal, development, or authenticated dashboard URLs.
Active Probing & Surface
12 checksDangling CNAMEs, exposed admin panels, open ports, GraphQL endpoints, and attack surface discovery.
Subdomain Takeover Vulnerability (Dangling CNAMEs)
Detects dangling CNAME records pointing to decommissioned third-party cloud services (AWS S3, GitHub Pages, Heroku).
Subdomain Exposure & Enumeration
Discovers active subdomains via Certificate Transparency logs and DNS resolution to map your external attack surface.
Discovered Subdomains Inventory
Generates a live inventory of discovered subdomains and assesses the risk posture of secondary microservices.
Open Redirect Vulnerability
Tests redirect parameters (?redirect=, ?return=, ?next=, ?url=) for unvalidated destination redirects.
GraphQL Introspection Exposed (/graphql)
Tests if GraphQL schema introspection (__schema query) is publicly enabled, disclosing complete schema designs and hidden queries.
HTTP Method Enumeration (PUT, DELETE, TRACE)
Tests which HTTP methods are permitted and flags dangerous legacy methods such as TRACE or unauthenticated PUT/DELETE.
Error Page Information Leakage
Triggers 404 and 500 error conditions to detect verbose stack traces, database error messages, or internal file paths.
Common Open Ports Scan (DB/Admin)
Scans public IP addresses for exposed non-web ports including SSH (22), MySQL (3306), Redis (6379), MongoDB (27017), and RDP (3389).
Web Application Firewall (WAF) Detection
Identifies active edge WAF protections (Cloudflare, AWS WAF, Fastly, Akamai) that block malicious traffic and Layer 7 attacks.
Malware & Phishing Blocklist Status
Queries global threat intelligence feeds (Cloudflare Threat Intel, Google Safe Browsing) to verify domain clean status.
Domain Name Risk Signals & Typosquatting
Analyzes domain characteristics (entropy, length, hyphens, suspicious TLDs) that correlate with phishing infrastructure.
Domain Age & Expiry Registration Health
Queries RDAP registration databases to monitor registration age and impending domain expiration.
Supply Chain & Dependencies
10 checksThird-party script audit, vulnerable client-side libraries, subresource integrity (SRI), and CDN bloat.
Known Vulnerable JavaScript Libraries
Scans loaded frontend scripts (jQuery, Lodash, Moment, Bootstrap) against Retire.js vulnerability databases.
Outdated Frontend Frameworks & Libraries
Identifies outdated versions of frontend frameworks (React, Vue, Angular, jQuery) that are missing security patches.
Subresource Integrity (SRI) Hashes
Verifies external CDN scripts and stylesheets include cryptographic hashes (integrity="sha384-...") to block CDN tampering.
Third-Party Domain Count & Blast Radius
Measures the total number of unique external domains loaded on the page to evaluate third-party risk exposure.
Outdated CMS Plugins & Themes (WordPress)
Detects active WordPress, Drupal, or Joomla plugins and checks for known vulnerabilities in publicly exposed asset paths.
Third-Party Script Inventory & Governance
Catalogs all client-side JavaScript tags and tracks their vendor ownership (analytics, customer chat, ads, A/B testing).
Unpinned CDN Resources (@latest)
Flags script tags loading unpinned CDN URLs (e.g. unpkg.com/package@latest) that can receive untested or malicious updates.
Foreign Tracking & Ad Scripts Audit
Audits advertising and behavioral tracking scripts for compliance with consumer privacy regulations (GDPR, CCPA).
Polyfill Supply Chain Risk (polyfill.io)
Detects usage of compromised polyfill services (e.g. polyfill.io) that redirect mobile users to malicious landing pages.
Prototype Pollution Indicators
Analyzes client-side object manipulation utilities for prototype pollution vulnerabilities (Object.prototype.__proto__).
Auth & Client-Side Security
12 checksSession entropy, DOM XSS sink vulnerabilities, login encryption, and form security.
Login Page Over HTTPS
Verifies that authentication forms (password, email inputs) and their target action endpoints are served exclusively over HTTPS.
Password Field Autocomplete Policy
Ensures sensitive password inputs leverage autocomplete="current-password" or "new-password" for password manager integration.
Multi-Factor Authentication (MFA) Support
Checks whether account portals support two-factor authentication (TOTP, WebAuthn/Passkeys, or SMS).
Session Token Shannon Entropy Analysis
Measures the randomness and bit-length of session identifiers to verify protection against session prediction attacks.
DOM-Based XSS Sink Analysis
Scans frontend JavaScript for dangerous execution sinks (eval, document.write, innerHTML, location.href) fed by unvalidated inputs.
Inline Script Analysis & Event Handlers
Audits raw <script> blocks and inline event attributes (onclick, onload) that bypass CSP nonce protections.
Form Security Analysis (Action URLs & CSRF)
Audits HTML forms for cross-origin submission targets, missing CSRF token protections, and insecure HTTP actions.
Clickjacking & UI Redress Defense
Evaluates frame embedding defenses to prevent deceptive UI overlays and clickjacking exploits.
Cross-Tab Opener Leakage (rel="noopener")
Ensures external links with target="_blank" declare rel="noopener noreferrer" to prevent reverse tab-nabbing.
Clipboard Hijacking Vulnerability
Scans for suspicious navigator.clipboard writes and copy event listeners that tamper with copied cryptocurrency or terminal strings.
WebSocket Encryption (WSS Enforcement)
Checks that all WebSocket connections negotiate secure wss:// protocols rather than unencrypted ws:// connections.
PII Exposure in Source Code
Scans HTML and script files for exposed Personally Identifiable Information (hardcoded emails, phone numbers, SSNs).
Compliance & Data Privacy
9 checksReadiness indicators for OWASP Top 10, GDPR, SOC 2, and PCI DSS compliance standards.
OWASP Top 10 (2021) Control Mapping
Maps automated findings against the OWASP Top 10 standard categories (Broken Access Control, Cryptographic Failures, Injection).
GDPR Compliance & Cookie Governance
Evaluates consent management mechanisms, cookie disclosures, and privacy policy availability under EU GDPR.
PCI DSS v4.0 Payment Security Readiness
Audits payment form security against PCI DSS requirements (TLS 1.2+, HTTPS enforcement, script integrity on checkout).
SOC 2 Type II Security Readiness Indicators
Assesses security controls supporting SOC 2 Trust Services Criteria (Security, Confidentiality, and Availability).
HIPAA Basic Security Safeguards
Checks technical transmission security safeguards (encryption in transit) required for protected health information (ePHI).
PII Exposure in Rendered HTML
Scans public HTML for leaked sensitive personal data including national identification numbers, credit cards, or internal email patterns.
Data Leaks in HTML Comments
Inspects HTML source code for un-stripped developer comments (<!-- TODO: ... -->) leaking internal paths or credentials.
Privacy Policy & Terms Link Presence
Verifies the website contains a clear, crawlable link to an accessible Privacy Policy in the page footer or navigation.
Cookie Consent & Tracking Banner
Checks for the presence of an active Cookie Consent banner or Consent Management Platform (CMP) for visitor privacy.
Audit Your Website for All 98 Vulnerabilities
Run an instant automated scan covering TLS certificates, HTTP security headers, DNS records, API key leakage, and dangling subdomain takeovers.