How we scan
SecScan's free checkers are passive. They read only the public configuration your site already exposes to any visitor — the same thing a browser or a single curl request sees — and never perform intrusive testing. This page explains exactly what that means and where the limits are.
Passive, not intrusive
Every public tool on this site makes ordinary requests and reads the response. It does not log in, submit forms, fuzz inputs, attempt exploits, brute-force anything, or probe internal systems. There is nothing for your site to defend against: the configuration we read is already public the moment your site is online. A scan is comparable in impact to a handful of normal page loads.
What each checker reads
- Security Headers — the HTTP response headers your site returns (HSTS, CSP, X-Frame-Options and others), graded against current best practice.
- Email / DMARC — the public DNS records that govern email authentication: SPF, DKIM, DMARC and MX. We make no connection to your mail server and send no email.
- Website Security Score — a combined A–F grade across your security headers, TLS/SSL configuration and any sensitive files that respond publicly.
How the A–F grade is built
The score combines three weighted, passive signals — HTTP headers, TLS configuration and exposed files — plus an informational technology-fingerprint signal. Each category starts at 100 and loses points by severity; the weighted result maps to a 0–100 number and an A–F letter. Hard caps apply: a single critical issue caps the grade at F and a high-severity issue caps it at C, so a strong average can never hide one serious leak. The full reasoning is in the website security guide.
What we deliberately do not do
The open checkers do not infer vulnerabilities from version banners. Guessing a CVE from a version string produces false criticals — vendors backport patches without changing version numbers, and banners are often spoofed or stripped — and a result you cannot trust is worse than no result. Checks against the CISA Known Exploited Vulnerabilities catalog are reserved for the authenticated full external scan, where there is enough verified context to report them responsibly.
Safety and authorization
Because reading public configuration is non-intrusive, it is lawful to check any site the same way a browser would. Even so, we ask that you only scan domains you own or are authorized to assess. Results are a point-in-time read, shown to you in your browser and not published. For the limits on how to interpret a result, see the disclaimer.