What is a website security checker?

A website security checker is an automated web risk assessment tool that scans live web applications for external security risks, OWASP Top 10 vulnerabilities, misconfigured HTTP headers, exposed API secrets, and server data leaks. Igris Radar acts as a complete website security checker and vulnerability scanner with severity-ranked findings and AI remediation steps.

What is Subdomain Radar and how does it detect takeover risks?

Subdomain Radar enumerates your public subdomains from Certificate Transparency (CT) logs and DNS records, then automatically audits each subdomain for takeover risks—such as dangling CNAME records pointing to decommissioned S3 buckets, Heroku apps, or GitHub Pages.

Does it detect vulnerable JavaScript libraries?

Yes. We fingerprint the exact version of every JavaScript library your page loads and check each one against the OSV vulnerability database, which aggregates GitHub, npm and other advisories. You get the specific CVEs and the version to upgrade to - not a generic "update your dependencies."

What does the AI security analysis do?

After the scan, an AI analyst reviews your findings and streams back a plain-language report: an executive summary and prioritized risks on every paid tier, plus attack-chain threat modeling, OWASP Top 10 mapping, copy-paste remediation code, and GDPR / PCI compliance readiness on the Pro plan. It turns a list of findings into a clear plan of what to fix first and why.

Is this a penetration test?

No. A penetration test is a manual engagement by security experts. Igris Radar is a continuous, automated security audit - the layer you run weekly to catch configuration drift, leaked keys, vulnerable dependencies, and missing headers between deeper engagements.

Do I need to install anything?

No agents, no DNS changes, no code snippets. Enter a URL and the scanner analyses everything visible from the outside - the same vantage point an attacker has.

Is substack.com secure?

substack.com scored 88/100 (Grade A) on Igris Radar's automated security audit evaluating TLS certificates, HTTP response headers, cookie hardening, and DNS authentication records.

What security checks were run on substack.com?

Checks included TLS 1.3 encryption, HSTS preload status, Content Security Policy (CSP) validation, clickjacking defenses (X-Frame-Options), cookie HttpOnly/Secure flags, and email authentication records (SPF, DMARC).

Substack

Verified Audit

substack.com

Last evaluated: September 2026

Overall Score

88%

Security Grade A

0Good

Checks Passed

Warnings

Failed Issues

Total Evaluated

Category Score Breakdown

Transport / TLS

96%

Security Headers

88%

Cookies & CORS

92%

DNS & Email

94%

Secrets & Files

100%

Attack Surface

87%

Security Topology Tree — substack.com

Interactive node visualization showing security controls, certificates, headers, and risk posture.

Interactive Tree Graph

Generating Domain Topology...

Audited Security Controls (8)

Transport & TLS

HTTPS Enforcement & Modern TLS

Verifies encrypted transport, cipher strength, and absence of legacy protocols.

Fix: Maintain TLS 1.3 with forward secrecy.

critical

Passed

Transport & TLS

Strict-Transport-Security (HSTS)

Forces modern browsers to communicate exclusively over HTTPS.

Fix: Configure max-age >= 31536000 with includeSubDomains.

high

Passed

HTTP Security Headers

Content Security Policy (CSP)

Restricts sources from which scripts and styles can load to prevent XSS.

Fix: Adopt strict-dynamic nonces and eliminate unsafe-inline.

critical

Passed

HTTP Security Headers

Clickjacking Protection (X-Frame-Options)

Guards against clickjacking and UI redressing attacks.

Fix: Set X-Frame-Options to DENY or SAMEORIGIN.

high

Passed

Cookies & CORS

Cookie Security Flags (HttpOnly & Secure)

Protects session tokens from theft via client-side scripts.

Fix: Mark all session cookies HttpOnly and Secure.

critical

Passed

DNS & Email Trust

Email Spoofing Defense (SPF & DMARC)

Validates SPF and DMARC enforcement to prevent domain impersonation.

Fix: Enforce DMARC p=quarantine or p=reject.

high

Passed

Secrets & Exposure

Public Secrets & Sensitive File Exposure

Probes for .env, .git, backups, and exposed credentials in client bundles.

Fix: Clean scan: no leaked keys or exposed files found.

critical

Passed

Attack Surface & Probing

Subdomain Takeover & CNAME Radar

Audits DNS records for dangling pointers to abandoned cloud services.

Fix: No dangling DNS records detected.

high

Passed

Continuous Drift Monitoring

Protect your production site against configuration drift. Igris Radar can audit substack.com daily and notify your team via Slack or Email if a certificate expires or headers are removed.

Audit Your Own Domain

Run all 90+ security checks against your website for free. Instant results in under 30 seconds with no installation required.