What we scan
The categories of checks we run against your site.
We don’t run every check against every site. After fingerprinting your stack, we select the checks that actually apply — a WordPress site gets WordPress checks, a site behind a CDN gets origin-exposure checks, and so on. Everything is external and non-destructive. Here’s the shape of what we look at.
TLS / SSL configuration
Protocol versions (flagging deprecated TLS 1.0/1.1), cipher strength, certificate validity and chain, and HSTS. Weak or outdated transport security is one of the most common — and most fixable — issues we find.
HTTP security headers & cookies
Content-Security-Policy, HSTS, X-Frame-Options / framing protection, referrer and permissions policies;
cookie Secure/HttpOnly/SameSite flags and over-broad cookie scope;
CORS misconfiguration; dangerous HTTP methods; and information leaked in response headers.
DNS & email hygiene
SPF, DKIM and DMARC records; CAA; dangling records vulnerable to subdomain takeover; and origin IP addresses exposed outside your CDN (which let an attacker bypass the CDN’s WAF entirely).
Exposure & misconfiguration
Exposed admin interfaces, sensitive files, framework debug pages and stack traces, secrets accidentally committed to HTML/JS, open redirects, reflected input, mixed content, Subresource Integrity gaps, and light content discovery of paths that shouldn’t be public.
CMS & application
CMS detection and version-specific exposure, with deeper checks for WordPress — user enumeration and known-vulnerable plugins and themes.
Known-vulnerable software
We match detected software and JavaScript library versions against public vulnerability data, then enrich each CVE with exploit-likelihood scoring (EPSS) and whether it’s on CISA’s Known Exploited Vulnerabilities list — so “40 CVEs” becomes “the 3 that are actually being exploited in the wild.”
Secrets & exposed services
Leaked API keys and credentials in public assets, and network ports/services that are reachable when they probably shouldn’t be.
New checks are added over time. What runs on a given scan depends on what we detect on your site.