Domain Security & Intelligence Scanner

Comprehensive automated vulnerability, configuration, and compliance assessment

Conducting DNS lookups, TLS handshakes, and challenge protocols... Please wait.
Overall Security Rating:
A+
🛡️ Perimeter & Transport Defence
Evaluates edge protection, transport encryption, and whether malicious actors can bypass Cloudflare/WAF proxy protections to strike the origin host directly.

Firewall / CDN

-
Identifies reverse proxies and web application firewalls filtering malicious HTTP traffic.

SSL/TLS Certificate

-
Verifies HTTPS handshake validity and flags expiring or invalid transport certificates.

Legacy Protocol Deprecation (TLS 1.0/1.1)

-
Checks whether deprecated, vulnerable TLS protocols are rejected by the remote host.

HTTP-to-HTTPS Redirection

-
Verifies whether unencrypted HTTP port 80 requests are automatically upgraded to encrypted HTTPS.

Certificate Authority Authorisation (CAA)

-
Restricts which Certificate Authorities are authorised to issue SSL/TLS certificates for this domain.

Origin IP Exposure (CDN Bypass)

-
Checks if public DNS A records expose the true host server IP rather than routed Cloudflare edge proxies.
✉️ Email Spoofing & Phishing Defence
Audits DNS mail policies. Missing or permissive policies allow cybercriminals to dispatch fraudulent phishing messages appearing directly from your domain.

Sender Policy Framework (SPF)

-
Specifies which mail exchange servers are permitted to send emails on behalf of this domain (enforces strict -all or softfail ~all).

DMARC Policy Enforcement

-
Instructs recipient mailboxes how to treat failing mail. Best practice requires p=quarantine or p=reject to neutralize spoofed messages.
🌐 Information Disclosure & Cross-Origin Policies
Detects technology banners leaking through HTTP response headers and audits Cross-Origin Resource Sharing (CORS) rules to safeguard authenticated resources.

Cross-Origin Resource Sharing (CORS)

-
Audits wildcard * or insecure origin reflection that could expose private API endpoints.

Server Signature Banners

-
Checks for server and runtime software banners advertising underlying server versions.
🔍 Engine & CMS Fingerprinting
Detects identifiable framework signatures. Publicly revealing specific build versions allows automated scanners to pinpoint CVE vulnerabilities.

PHP Runtime

-
Detects PHP signatures leaked via headers, session cookies, or source code anchors.

WordPress Version

-
Detects WordPress installations and estimates release versions via asset queries.
🍪 Cookie & Session Defence
Audits state-handling directives. Cookies missing HttpOnly can be stolen via XSS, whilst missing Secure or SameSite attributes leave sessions open to eavesdropping and CSRF attacks.

Cookie Security Overview

-
Summarises compliance across all Set-Cookie headers issued during initial site connection.
🔗 Content & Client-Side Link Safety
Audits DOM links for reverse tab-nabbing vulnerabilities and verifies that no sub-resources are loaded insecurely via mixed HTTP transport.

Mixed Content Verification

-
Flags unencrypted HTTP sub-resources (scripts, stylesheets, iframes, media) rendered on an HTTPS page.
📂 Sensitive File & Crawler Exposures
Tests sensitive endpoints for accidental exposure, including backup config files with database credentials, exposed version control repositories, and robots.txt disclosures.

Crawler Directives (robots.txt)

-
Audits whether crawler Disallow directives unintentionally advertise internal or administrative file locations.

Path Audit Results & RFC 9116 Security.txt

-
🔒 HTTP Defensive Response Headers
Evaluates modern browser instructions that mitigate Cross-Site Scripting (XSS), Clickjacking, MIME-type sniffing, and enforce strict encrypted transport (HSTS). Remediation guidance is provided for missing directives.
Header Requirement Status Value Received & Remediation Advice