What it reads
- Certificate expiry
- Read over a real TLS handshake, not looked up in a database. It reports the date and the days remaining, and flags anything inside 30 days. This is the one observation that is a fact about your site rather than an opinion about sites in general: a renewal date is not something anybody can argue with.
- Content-Security-Policy
- Whether one is set, and whether it is weakened past the point of doing much.
- HTTPS enforcement (HSTS)
- Whether the browser is told to refuse the plain-HTTP version next time.
- Clickjacking protection
X-Frame-Options, or the absence of it.- MIME sniffing protection
X-Content-Type-Options, or the absence of it.- Referrer policy
- What the site leaks to the places its visitors click through to.
- Camera, microphone and location
- The permissions policy, which most sites have never set at all.
- Email spoofing (SPF)
- Whether unlisted senders are refused, merely marked, or the record states no opinion.
- Email spoofing (DMARC)
- Whether forgeries are rejected, sent to spam, or only counted while still being delivered.
- Cookie flags
- What the site sets on the way in, and whether those cookies are protected.
- Version disclosure
- Headers whose only job is to announce what the site runs on.
- robots.txt and security.txt
- Whether the two files published specifically for automated readers exist. A missing
security.txtis not a vulnerability; it is the reason nobody could tell you about one.
What it does, request by request
There is no discovery step and nothing is guessed, so the whole thing is short enough to list:
- One
GETto the homepage over HTTPS. - One
GETto/robots.txtand one to/.well-known/security.txt— files that exist to be fetched by machines, and which a site that does not want read simply does not publish. - TXT lookups for the SPF and DMARC records, which are public DNS entries every mail server on the internet reads before accepting a message. Asking a resolver a question does not contact the site at all.
- One TLS handshake to read the certificate.
Redirects are not followed, only GET is used, the response body is read up to a small ceiling because the headers are the point, and the whole check is capped so it fails quickly instead of hanging while somebody watches a page. Resolved addresses go through the same guard as everything else, so the check cannot be pointed at private space either.
If the homepage redirects, the check says so rather than pretending. Headers on a redirect say very little, and a result that hides that is worse than one that admits it.
What it cannot tell you
It cannot tell you whether the site is secure. Nothing can. It reads a defined surface at a defined time and reports what it found there, and a clean result ages the moment it is produced.
It also cannot see anything the site does not volunteer. There is no vulnerability testing here, no path discovery and no fingerprint matching — those are what the full scan does, and they are exactly the acts that require proof you control the domain first. So the public check will never find the admin panel that answers when it should not, because it never asks.
And a missing header is not automatically a problem. Whether it matters depends on what the site is for, which is a judgement a person makes and an automated check should not pretend to have made for them.
Why it is free, and stays free
Partly because it costs almost nothing to run, and partly because the alternative was worse: before it existed, nobody could see a single result without first editing DNS for a client's domain — which is to say, before we had shown them anything at all.
The paid product is the full scan: it requests paths the site never advertised, tries known vulnerability fingerprints against them, and produces the report an agency hands to a client. That is where the compute goes and where the money is. Giving it away would have made the free plan the product and the paid ones a quantity discount on it.
Read next
- Certificate expiry monitoringThe one finding with a deadline attached, and what to do about it.
- SPF and DMARC, in plain termsWhy "we set up DMARC" usually means forgeries are still delivered.
- What a vulnerability scanner should tell youUseful automated checks, and where they need a human.
- About the Glarion crawlerWhat to do if you found us in your access log.