Scan Your Website for Security Vulnerabilities & Header Issues
Comprehensive security audit for your website. Identify missing security headers, exposed sensitive files, deprecated SSL protocols, and server configuration flaws.
📖 Learn more: What is HSTS and how to enable it
Understanding the Security Audit
Our tool performs a multi-layered analysis of your server's security posture. Here is a breakdown of what we check and why it matters.
Security Headers Analysis
HTTP Security Headers are directives sent by the server to the browser. They act as the first line of defense against modern web attacks.
- HSTS: Forces browsers to use encrypted connections only.
- CSP: Restricts which scripts/resources can execute, stopping XSS.
- X-Frame-Options: Prevents your site from being used in malicious iframes.
Information Disclosure
Attackers often start with "reconnaissance." If your server reveals its exact version or operating system, it becomes easier to find matching exploits.
- Server Signature: Hiding versions (e.g., Apache/2.4.41) reduces the attack surface.
- X-Powered-By: Reveals backend technology like PHP or ASP.NET versions.
Exposed Sensitive Files
Many developers accidentally leave configuration files in the web root. Our scanner checks for "high-value" targets that shouldn't be public.
- .env files: Often contain database passwords and API keys.
- .git folder: Can allow an attacker to download your entire source code.
- phpinfo(): Reveals internal server paths and PHP configuration details.
SSL/TLS Protocol Check
Not all encryption is created equal. Using legacy protocols like SSLv3 or TLS 1.0 makes your site vulnerable to known cryptographic attacks.
- SSLv3: Completely broken by the POODLE vulnerability.
- TLS 1.0/1.1: No longer compliant with modern PCI DSS standards.
- TLS 1.2/1.3: The current industry standards for secure communication.
Web Security Essentials
Locking down your server doesn't require complex tools. These high-impact configurations are the baseline for every professional, secure application today.
Enforce Modern Encryption
Retire legacy protocols that are vulnerable to modern attacks. Your server should prioritize high-security versions.
Prevent Clickjacking
Prevent malicious actors from embedding your site into hidden frames. Control framing using a standard security policy.
X-Frame-Options: SAMEORIGINRigid Transport Security
Use HSTS to mandate secure connections. Browsers will automatically block any attempt to connect over unsecure HTTP.
Strict-Transport-SecurityLock Private Asset Access
Ensure configuration files and source control data remain invisible. These assets should never be publicly reachable.
Frequently Asked Questions
Is this scan safe to run on my live site?
Yes, our scanner is non-invasive. It only performs HEAD/GET requests for headers and specific known "sensitive" paths. It does not perform brute-force attacks or exploit any vulnerabilities.
Why is my risk level "High" if my site works fine?
A site can be fully functional but still be insecure. For example, missing HSTS means a man-in-the-middle could redirect users to an unencrypted version of your site without them knowing.
How do I fix "Missing HSTS"?
You need to add the
Strict-Transport-Security header to your server configuration. On Apache, this is
done via Header always set Strict-Transport-Security. On Nginx, use
add_header Strict-Transport-Security.