Website security scanner: one score for the six things that get sites in trouble

A security scan reads the parts of your setup that any attacker, mail server or browser can see from the outside, then judges whether they are configured the way they should be. Every scan on this page returns:

• Whether the SSL/TLS certificate is valid, trusted, matches the hostname and how many days until it expires
• Which of the seven core HTTP security headers are present, missing or misconfigured
• Whether SPF, DKIM and DMARC are set so nobody can spoof email from the domain
• Whether the server IP is listed on any of ten major spam and threat blacklists
• Whether plain HTTP redirects cleanly to HTTPS, and whether HTTP/2 is enabled
• The web server banner, response code and response time
• A single 0–100 score, a letter grade and a prioritised list of issues to fix

This is a configuration and perimeter audit, not a full penetration test. It deliberately does not:

• Test application logic (SQL injection, XSS in your own code, broken access control)
• Scan for malware, defacement or backdoors in your files
• Run a full port scan or probe non-web services
• Detect outdated CMS versions, vulnerable plugins or leaked credentials

A clean grade here means your transport layer and configuration are sound, which is the baseline every site should clear first. It does not mean the application behind it is secure. For that you need code review and a real penetration test.

A certificate that merely exists is not the same as one that is configured correctly. The scanner opens a real TLS connection to port 443 and verifies the certificate the way a strict client would, then scores four things:

• Trust chain. The certificate must be issued by a trusted CA and present its full intermediate chain. A self-signed or chain-broken certificate fails verification even if the browser hides it.
• Hostname match. The Common Name or a Subject Alternative Name must match the domain (wildcards included). A mismatch wipes the SSL score, because it means visitors get certificate warnings.
• Expiry. Anything inside 30 days is flagged; an expired certificate is a hard fail. Automate renewal with Let’s Encrypt or your CA so this never bites.
• Key strength. At least 2048-bit RSA or 256-bit EC. Weaker keys are treated as breakable.

For a deeper certificate breakdown (chain, ciphers, protocol versions) use the dedicated SSL Checker.

Security headers are the highest-value, lowest-effort win on most sites: a few lines of config, no code changes, and they shut down entire categories of attack at the browser. Each header set correctly is worth 5 points.

Strict-Transport-Security (HSTS)

Tells browsers to only ever connect over HTTPS, blocking SSL-stripping downgrade attacks. Full marks need a max-age of at least one year (31536000 seconds).

Content-Security-Policy (CSP)

The single strongest defence against cross-site scripting and data injection. It whitelists where scripts, styles and frames may load from, so injected code simply does not run.

X-Frame-Options

Stops your pages being embedded in a hostile iframe (clickjacking). Should be DENY or SAMEORIGIN.

X-Content-Type-Options

Set to nosniff so browsers do not second-guess declared content types, which closes off a class of MIME-confusion attacks.

Referrer-Policy

Controls how much of your URLs leak to other sites in the Referer header. strict-origin-when-cross-origin is a sensible default.

Permissions-Policy

Restricts access to powerful browser features (camera, microphone, geolocation) so third-party scripts cannot quietly use them.

X-XSS-Protection

A legacy header for old browsers. Modern protection comes from CSP, but a correct value is still checked.

These three DNS-based records decide whether anyone can send email pretending to be from your domain. Getting them right is one of the highest-impact things a domain owner can do, and it protects your brand even if you never send mail at all.

• SPF lists which servers may send mail for your domain. Ending it with -all (hard fail) scores full marks; ~all (soft fail) is weaker and only partly scored.
• DKIM cryptographically signs your outgoing mail so receivers can verify it was not tampered with. The scanner probes the common selectors.
• DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails. p=reject is the goal; p=quarantine is partial; p=none is monitoring only.

A domain with no SPF and no DMARC is trivially spoofable. For a full breakdown with the exact records to publish, use the Email Security Checker.

Blacklists (10 pts). The domain is resolved to its IPv4 address and checked against ten major DNSBLs including Spamhaus ZEN, SpamCop, SORBS, Barracuda and UCEPROTECT. A single listing zeroes this category, because it hurts email deliverability and lowers trust scores in some security products. See the per-list breakdown in the IP Blacklist Checker.

HTTPS redirect (5 pts). Visitors who type your address without https:// should be sent to the secure version automatically with a 301 or 308. No redirect means a window where traffic travels in the clear.

HTTP/2 (5 pts). The modern HTTP version multiplexes many requests over one connection and loads pages noticeably faster than HTTP/1.1. It is table stakes for any well-run site and a small signal that the stack is kept current.

Most low scores come from the same handful of missing pieces. The fixes are quick:

Add the security headers (Apache)

In your .htaccess or vhost, with mod_headers enabled:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Content-Security-Policy "default-src 'self'"

Add the security headers (Nginx)

Inside the server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'" always;

Start your CSP loose and tighten it as you confirm nothing breaks; a too-strict CSP can block your own scripts. SPF and DMARC are single DNS TXT records at your registrar; DKIM keys come from your mail provider. Re-run the scan after each change to watch the grade climb.