securityscanner.org

What gets checked

One line: eight things the public internet can already see about your site, graded A to F, plus a monthly crawl of every page once you verify the domain. No attacks, no logins, at most 25 requests.

The checks

Each one is a question an attacker's bot asks your site in its first few seconds. The scanner asks the same questions and tells you the answers first.

  • Encryption (TLS)

    Confirmed email

    Does your site force https, and is the connection set up with modern settings? The scanner checks the certificate is valid and who issued it, how many days until it expires, that it matches the name, that old protocol versions (TLS 1.0 and 1.1) are turned off, and that http redirects to https on both the bare domain and www.

    Why it matters: a weak or expired certificate means browsers warn visitors away, and old protocols let someone on the same network read the traffic.

  • Security headers

    Confirmed email

    Your server sends a few lines of instructions to every browser. The scanner looks for the ones that matter: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or frame-ancestors, Referrer-Policy and Permissions-Policy. It also notes headers that give away too much, like the exact server or framework version.

    Why it matters: these headers are the cheapest protection there is against scripts injected into your pages and against your site being framed inside someone else's.

  • Email spoofing protection

    Confirmed email

    Three DNS records decide whether other people can send email that looks like it came from you. SPF lists who may send for your domain. DKIM signs each message. DMARC tells receiving mail servers what to do when a message fails those checks, and where to send reports. The scanner reads all three, checks the syntax and the SPF lookup count, looks for DKIM keys at six common selector names, and flags a DMARC policy of none, which means failing mail is still delivered.

    Why it matters: a domain without DMARC is the easiest thing in the world to impersonate. Fake invoices to your customers come from exactly this gap.

  • DNS hygiene

    Confirmed email

    Whether DNSSEC is on, whether there is a CAA record (it limits who can issue certificates for you), and whether www points at a name that no longer exists.

    Why it matters: a dangling record can be claimed by a stranger, who then serves content on a name that looks like yours.

  • Exposed files and folders

    Confirmed email

    A short list of well-known paths that should never be public: .git, .env, wp-config backups, backup archives, .DS_Store, phpinfo pages, server-status, XML-RPC. Each is one ordinary GET request. The scanner reads only enough to tell whether the real file answered, so a site that says 200 to everything does not false-alarm, and it never stores the contents.

    Why it matters: a readable .env or .git folder usually contains passwords and keys for everything else.

  • WordPress

    Confirmed email

    If the site runs WordPress, the scanner reads the core version and the versions of plugins and themes that announce themselves in the page source, and compares them with the current releases. It also notes whether XML-RPC is open. It does not list user names and it does not touch the login page.

    Why it matters: out-of-date plugins are the single most common way small business sites get taken over.

  • Page hygiene

    Confirmed email

    Scripts, styles or images on the https home page that still load over plain http, old versions of jQuery, and cookies set without the Secure or HttpOnly flags.

    Why it matters: an insecure script on a secure page can be swapped for a malicious one, and browsers block or warn about it.

  • Open ports

    Confirmed email

    Which of 17 common ports answer from the internet on your web server's address. A website needs 80 and 443. Databases (3306, 5432, 6379, 27017), remote desktop (3389), SSH (22), FTP (21) and the like open to the world are noted. The scanner only tries to connect; it sends nothing and reads nothing from the port. When the address belongs to a CDN, it says so instead of judging the CDN's edge.

    Why it matters: a database port open to the internet is a door with no building around it.

  • The monthly crawl

    Verified domain

    Once you prove you control the domain, the scanner crawls every page your site links to, not only the home page, and runs passive rules on each response: cookie flags, headers page by page, information leaks in comments and error pages, old JavaScript libraries, forms that post over plain http. It is the same baseline scan I run for agency clients. It reads what each page sends back and changes nothing.

  • The active scan

    Opt-in, coming later

    Coming later. Sends requests that resemble attacks to find problems the passive checks cannot. It can fill in forms and create, modify or delete data, so it will be a separate yes for each domain, with the scanner's own warning shown first, and never on by default. Best pointed at a staging copy of the site. Until then, nothing here submits a form or attacks.

What a grade means

A grade per check, and one overall. The overall grade is a weighted average, held down to one letter above the worst of the four big checks (encryption, exposed files, email protection, security headers), and held at D or below when anything critical is exposed. An attacker only needs one open door.

  • Good.90 to 100. Nothing to do here this month.
  • Small improvements.80 to 89. Not urgent. Do it when you next touch the site.
  • Needs attention.70 to 79. A real gap. Fix it in the next few weeks.
  • Fix soon.60 to 69. A weakness that attackers' tools look for and use.
  • Fix now.Under 60. Something serious is exposed to the whole internet today.

Every finding comes with what it is, why it matters, what to change, and roughly how hard that is: a setting, an hour, or a job for your developer or host. If something is at F, the email says so in the subject line. The same result is available as JSON, following a published schema.

What the scanner never does

  • No attacks. No exploit attempts, no injection, no password guessing, no denial of service, nothing that could change data or take your site down. The active scan is a separate choice and is not running for anyone yet.
  • No logins. The scanner has no account on your site and never tries to make one. It only reads what any visitor can read.
  • No forms. It does not submit contact forms, searches or checkouts.
  • No downloading. If an exposed file is found, the scanner reads just enough to know it is real and stops. It never stores the contents.
  • At most 25 web requests per scan at the confirmed-email level, with about 25 DNS lookups and one connection attempt to each of 17 ports. Less traffic than one person browsing your site. The verified crawl makes more requests, one per page, still at a gentle rate.
  • One fixed, named source IP, published on the page about the scans before the first scan of anyone else's domain, and a User-Agent on every request that names this site and links to that page.
  • Only domains whose owner has proved it: a confirmed email at the domain, or a DNS record or file. The proof is checked again before every run. Never anyone else's site.
  • Stop at any time: unsubscribe from any report, remove the record or file, or write to abuse@securityscanner.org, and the domain is not scanned again.