Transport & Encryption
15 pts
HTTPS & TLS Encryption
Verifies mandatory encryption over HTTPS and modern TLS protocols, eliminating plaintext interception.
Baseline standard for protecting data confidentiality.
Security Scanner & Verification
Security scanner
Advanced security scanning tool for threat auditing, transport encryption, and HTTP header protection posture.
What Does This Scanner Audit?
An open, public utility to analyze any website against modern web vulnerabilities across 8 core security dimensions:
Transport & Encryption
15 pts
Strict-Transport-Security (HSTS)
Audits HSTS headers and max-age duration to protect browsers against SSL stripping attacks.
Recommended max-age of at least 6 months with includeSubDomains.
Content Security Policy
20 pts
Content-Security-Policy (CSP)
Checks script and resource restrictions to eliminate Cross-Site Scripting (XSS) and code injection.
Strongest browser defense against client-side injection.
Clickjacking Defense
10 pts
Anti-Clickjacking Headers
Inspects X-Frame-Options and frame-ancestors to prevent malicious iframe overlays.
Protects forms and authentication flows from deception.
MIME & Content Security
10 pts
MIME-Sniffing Protection
Ensures X-Content-Type-Options: nosniff blocks executable MIME misinterpretation.
Blocks drive-by execution of user-supplied assets.
Privacy & Device Controls
10 pts
Referrer-Policy Header
Verifies referral metadata policies to prevent token and query parameter leakage.
Protects user navigation privacy across domains.
Privacy & Device Controls
10 pts
Permissions-Policy Header
Audits hardware API restrictions (camera, microphone, geolocation) in the browser.
Eliminates unauthorized access to client hardware APIs.
Information Disclosure
10 pts
Server Signature Masking
Checks whether server headers and X-Powered-By banners mask software versions.
Reduces automated reconnaissance by malicious scanners.
Web Security Architecture Best Practices
Modern web security requires defense-in-depth across transport encryption, browser policies, and origin shielding:
1. Transport & Strict HSTS
Enforce HTTPS universally with 1-year HSTS max-age and preloading to eliminate protocol downgrade and SSL-stripping attacks.
2. Content Security Policy (CSP)
Implement strict Content Security Policy with cryptographic nonces or allowlists to eliminate Cross-Site Scripting (XSS) vectors.
3. Frame & Clickjacking Defense
Configure X-Frame-Options: DENY and frame-ancestors to block framing in hidden iframes and prevent clickjacking.
4. Cookie & Response Hardening
Enforce HttpOnly, Secure, and SameSite flags on all cookies alongside nosniff and strict referrer restrictions.