58 Security Checks
Comprehensive security scanning across TLS, headers, content, and DNS. All 58 checks included on every scan.
Headers Security
HTTP security headers protect against XSS, clickjacking, and other browser-based attacks.
Content Security Policy (CSP)
Content Security Policy is an HTTP header that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which content sources are allowed to load.
HSTS enabled
HTTP Strict Transport Security (HSTS) tells browsers to only access your site over HTTPS, preventing protocol downgrade attacks and cookie hijacking.
Frame Security Policy
Frame security controls whether your page can be embedded in iframes on other sites, protecting against clickjacking attacks.
Set-Cookie headers
Cookie security attributes (Secure, HttpOnly, SameSite) protect session cookies from theft and cross-site attacks.
Trusted Types readiness
Trusted Types is a browser API that helps prevent DOM-based XSS by requiring typed objects for dangerous DOM operations.
X-Content-Type-Options header
This header prevents browsers from MIME-sniffing a response away from the declared content-type, stopping certain attack vectors.
Permissions-Policy header
Permissions-Policy (formerly Feature-Policy) controls which browser features can be used on your page and in embedded content.
Server information disclosure
Server headers that reveal software versions can help attackers identify vulnerable components to exploit.
Content-Type header
The Content-Type header specifies the MIME type of the response, ensuring browsers handle content correctly.
Referrer Policy
Referrer-Policy controls how much referrer information is sent when navigating away from your site.
Deprecated X-XSS-Protection header
X-XSS-Protection was a browser feature to detect XSS attacks, but it's now deprecated and can actually introduce vulnerabilities.
Cross-Origin Resource Isolation
Cross-origin isolation headers (COEP, COOP, CORP) enable powerful features like SharedArrayBuffer while protecting against Spectre attacks.
HTTP Methods Check
HTTP methods like TRACE, PUT, DELETE, and CONNECT can expose your server to Cross-Site Tracing (XST) attacks, unauthorized file manipulation, and server-side request forgery if left enabled unnecessarily. Most web applications only need GET, POST, and HEAD.
Cookie Security Prefixes
Cookie prefixes (__Host- and __Secure-) provide additional browser-enforced security guarantees for cookies.
Access-Control-Allow-Credentials
This CORS header determines whether browsers should expose responses to frontend JavaScript when credentials are included.
Access-Control-Allow-Headers
This CORS header specifies which HTTP headers can be used during the actual cross-origin request.
Access-Control-Allow-Origin
This CORS header specifies which origins can access your resources, controlling cross-origin data sharing.
Access-Control-Expose-Headers
This header specifies which response headers should be exposed to JavaScript in cross-origin requests.
Access-Control-Max-Age
This header specifies how long browsers can cache preflight request results.
Cross-Origin-Embedder-Policy
Cross-Origin-Embedder-Policy (COEP) is an HTTP security header that controls which cross-origin resources a document is allowed to load. When set to require-corp, it requires that all cross-origin resources explicitly opt in via the Cross-Origin-Resource-Policy (CORP) header or CORS. Together with Cross-Origin-Opener-Policy (COOP), COEP enables a security state called cross-origin isolation.
Cross-Origin-Opener-Policy
COOP isolates your browsing context from cross-origin documents, preventing certain cross-origin attacks.
Cross-Origin-Resource-Policy
CORP specifies which origins can include your resources, providing protection against cross-origin attacks.
Vary: Origin header (CORS caching)
The Vary header tells caches to store separate versions of responses based on request headers like Origin.
TLS Security
TLS/HTTPS checks verify encryption, certificates, and secure connection configuration.
HTTPS enabled
HTTPS encrypts all traffic between browsers and your server, protecting data confidentiality and integrity.
HTTP to HTTPS Redirect
Redirecting HTTP requests to HTTPS ensures users always connect securely, even if they type HTTP URLs.
TLS Version
The TLS protocol version determines the security and features available for encrypted connections.
Deprecated TLS versions
TLS 1.0 and 1.1 are deprecated due to security vulnerabilities and should be disabled.
Cipher Suite
Cipher suites determine the encryption algorithms used for TLS connections.
Certificate Expiry
SSL/TLS certificates have expiration dates and must be renewed before they expire.
Mixed Content
Mixed content occurs when HTTPS pages load resources (scripts, images, etc.) over insecure HTTP.
HSTS Preload Readiness
HSTS preload ensures browsers always use HTTPS for your domain by hardcoding it into browser source code via the HSTS preload list.
Certificate Hostname & Chain
Certificates must match your domain name and include all intermediate certificates for validation.
OCSP Stapling
OCSP (Online Certificate Status Protocol) stapling is a TLS extension that allows your web server to proactively provide certificate revocation status to browsers during the TLS handshake. Instead of requiring clients to contact the Certificate Authority (CA) directly, your server attaches ('staples') a cached, CA-signed OCSP response to the handshake, confirming the certificate has not been revoked.
Content Security
Content checks identify exposed files, vulnerable libraries, and information disclosure.
Security.txt (RFC 9116)
Security.txt is a standard file that tells security researchers how to report vulnerabilities responsibly.
Robots.txt Security Audit
Robots.txt controls search engine crawling but can inadvertently reveal sensitive paths.
Directory Listing Detection
Directory listing allows anyone to browse the file structure of your web server, potentially exposing sensitive files and internal paths.
Reverse Tabnabbing Protection
Reverse tabnabbing is an attack where a page opened via target="_blank" can hijack the original tab using the window.opener API.
Sensitive Files Exposure
Common sensitive files like .env, .git, backups, and config files should not be publicly accessible.
Vulnerable JS Libraries
JavaScript libraries with known vulnerabilities can be exploited by attackers.
Anti-CSRF Tokens
CSRF tokens prevent attackers from tricking users into performing unwanted actions.
Exposed Admin Panels
Publicly accessible admin panels are a common target for attackers attempting unauthorized access.
Subresource Integrity (SRI)
SRI allows browsers to verify that external resources haven't been tampered with.
Source Map Exposure
Source maps help debug minified code but can expose your original source code if publicly accessible.
HTML Comments Information Disclosure
HTML comments in production can reveal sensitive information like TODOs, internal notes, or debug data.
Private IP Disclosure
Private IP disclosure occurs when internal network addresses leak through HTTP headers or page content, revealing infrastructure details.
PII Disclosure
PII (Personally Identifiable Information) disclosure occurs when sensitive data like credit card numbers or social security numbers appear in page content.
Technology Fingerprinting
Technology fingerprinting detects the specific software, frameworks, and versions running on your server through headers, meta tags, and code patterns.
Open Redirect Detection
Open redirects allow attackers to craft URLs on your domain that redirect users to malicious external sites.
Dangerous JavaScript Functions
Dangerous JavaScript functions like eval(), document.write(), and innerHTML can introduce DOM-based XSS vulnerabilities when used with untrusted input.
DNS Security
DNS checks verify email authentication, DNSSEC, and domain security configuration.
Email Domain Security (SPF/DKIM/DMARC)
Email authentication protocols prevent attackers from sending spoofed emails that appear to come from your domain.
DNS Security
DNS security includes DNSSEC and proper resolver configuration to prevent DNS attacks.
CAA DNS Records
Certificate Authority Authorization records specify which CAs are allowed to issue certificates for your domain.
Open Ports
Unnecessary open ports increase your attack surface and may expose vulnerable services.
Subdomain Takeover
Subdomain takeover occurs when DNS records point to deprovisioned external services that attackers can claim.
SPF Lookup Limit
SPF records are limited to 10 DNS lookups per RFC 7208. Exceeding this limit causes SPF validation failures and email delivery issues.
DANE/TLSA Records
DANE (DNS-based Authentication of Named Entities) uses TLSA DNS records to cryptographically bind TLS certificates to domain names via DNSSEC.
BIMI Records
BIMI (Brand Indicators for Message Identification) allows your brand logo to appear next to authenticated emails in supporting email clients.
MTA-STS Policy
MTA-STS (Mail Transfer Agent Strict Transport Security) enforces TLS encryption for emails sent to your domain, preventing SMTP downgrade attacks.
Run All 58 Checks on Your Website
Get a comprehensive security report with actionable fix recommendations in seconds.
Start Free Scan