Skip to main content

About SecScanner

SecScanner is a website security scanner and monitoring service. Enter a domain and it runs 62 automated checks across TLS, HTTP headers, page content and DNS, then explains every failed check in plain language with the exact configuration to fix it. 24 checks are free with no signup; paid plans add the rest, scheduled re-scans and alerts when something regresses.

How we test

Every check is non-intrusive: we only send the kind of requests a normal visitor or mail server would. We do not brute-force logins, submit forms, fuzz parameters or try to exploit anything we find. A full scan takes 1–3 minutes.

TLS · 10 checks

We open TLS handshakes to your server and record which protocol versions and cipher suites it accepts, then validate the certificate chain, hostname and expiry date.

Headers · 23 checks

We fetch your homepage like a browser would and read the HTTP response headers: CSP, HSTS, framing, CORS, cookies, cross-origin isolation and more.

Content · 20 checks

We read the page your server returns and request a fixed list of well-known paths (robots.txt, security.txt, common exposed files) to spot outdated JavaScript libraries, leaked source maps and information disclosure.

DNS · 9 checks

We query public DNS resolvers for your SPF, DKIM, DMARC, CAA, DNSSEC, MTA-STS and related records, look for dangling subdomains, and check which common ports accept a connection.

Each check has its own page explaining what it tests, why it matters and how we decide pass or fail — browse them in the security checks library.

Standards behind the checks

  • RFC 8996 — Deprecating TLS 1.0 and TLS 1.1
  • RFC 6797 — HTTP Strict Transport Security (HSTS)
  • RFC 9116 — security.txt
  • RFC 7208 / RFC 7489 — SPF and DMARC
  • RFC 8461 — SMTP MTA Strict Transport Security
  • OWASP Secure Headers Project — Recommended HTTP response headers
  • W3C Content Security Policy Level 3 — CSP directives and their pitfalls

Our data

We re-scan 101 of the most-visited websites on a schedule and publish the results as public security reports. The aggregate figures — which protections the biggest sites skip — are in our website security statistics.

Responsible use

Scan sites you own or operate. If you believe a result is wrong, our scanner misbehaved against your server, or you found a vulnerability in SecScanner itself, email hello@secscanner.app — see also our contact page.