SCANNER INTERNALS

How the Scan Engine Works

A transparent, reproducible pipeline that inspects transport security, response headers, rendered HTML, DNS configuration, email authentication, and third-party tracking from a single URL.

TLS enumerationCurated tracker DBMTA-STS & BIMIExposure probesHSTS preload lookup

The Pipeline

Six stages, one deterministic result.

Every scan flows through the same ordered pipeline. Side-channel probes (TLS, DNS, email, exposure) run in parallel so total wall-clock time stays under the timeout budget.

01
Validate
Normalize URL, block private IPs, enforce DNS rebinding defense
02
Resolve
DNS lookup with IP pinning across the entire request chain
03
Request
Follow redirects (max 5), capture headers and body at each hop
04
Probe
Parallel side-channels: TLS enum, DNS records, email auth, exposures
05
Parse
Analyze HTML for trackers, SRI, mixed content, inline handlers
06
Score
Weighted category scores, grade caps from fatal findings, remediation output

Scan Categories

Six surfaces. Hundreds of signals.

The scoring engine weights categories independently so that one weak surface cannot mask strong performance elsewhere. Categories marked "signal" are reported but never penalize the final grade.

0135%

Transport Security

The handshake is where trust begins. We enumerate every TLS version the server accepts, probe for weak cipher suites, and verify that forward secrecy, OCSP stapling, and certificate chains are wired correctly.

0235%

Content & Headers

Your response headers are the last line of defense against XSS, clickjacking, and MIME confusion. We parse Content-Security-Policy directive-by-directive and validate every modern isolation header.

0315%

Privacy & Trackers

The curated tracker database covers analytics, advertising, session-replay, tag managers, and social pixels. We parse the rendered HTML and flag every third-party origin that matches a known signature.

04signal

Email Authentication

A properly configured domain publishes more than SPF and DMARC. We probe the full stack including DKIM key publication, MTA-STS enforcement, TLS reporting destinations, and BIMI branding.

0515%

Cookies & CORS

Cookies carry authentication state. CORS controls cross-origin access. A wildcard ACAO with credentials is the canonical critical misconfiguration, and we cap the grade accordingly.

06signal

DNS & Exposure

DNS controls who can issue certificates and whether responses are validated. We also probe well-known sensitive paths to surface leaked secrets, repository metadata, and exposed status endpoints.

Grading

From a 0 to 100 composite score to a familiar letter grade.

Category scores are combined by weight, then specific fatal findings can cap the result regardless of the composite. An expired certificate caps at F. No HTTPS caps at F. A wildcard CORS with credentials, an exposed .git/.env, a weak cipher accepted, or a hostname mismatch each cap at D.

Grade

Score

Meaning

A+

97 - 100

Near-perfect. Modern TLS, full header suite, no exposed paths.

93 - 96

Strong posture. Minor informational items.

A-

90 - 92

Strong with one or two small gaps.

B+

87 - 89

Good baseline. A few targeted improvements recommended.

83 - 86

Solid baseline. Several improvements recommended.

B-

80 - 82

Acceptable. Notable gaps in header or TLS coverage.

C+

77 - 79

Below baseline. Multiple weak headers or cookies.

73 - 76

Weak. Multiple structural issues.

C-

70 - 72

Borderline. Several notable gaps just short of D.

60 - 69

Structural issues. Often triggered by a single fatal finding.

0 - 59

Critical failure. No HTTPS, expired cert, or exposed secrets.

Guarantees

No account. No queue. No data retention.

Deterministic output

Same URL, same headers, same result. No LLMs in the scoring path.

IP-pinned requests

DNS resolves once; every follow-up request pins to the same IP to block rebinding attacks.

Bounded cost

Timeouts and byte caps on every external request. No unbounded resource consumption.

Fail open

A single broken probe never blocks the rest of the scan. Partial results are still actionable.

Run your first scan.

No signup. Results in under ten seconds for most sites.

Start Scan