SecureScan

How SecureScan works

SecureScan only reads what your site already shows the public. It does not log in, does not exploit anything and does not keep the pages it reads. Here is what happens to an address you enter.

Checking a website

  1. Fetch

    The page is requested through a guard that refuses private and internal addresses, so a check can never be aimed at a network it should not reach.

  2. Inspect

    Security headers, the TLS certificate, the technologies in use, files that should not be public, risky cross-origin settings and secrets left in front-end code.

  3. Judge

    One rule engine turns what was observed into findings, each with a severity and the evidence behind it.

  4. Explain

    Every finding gets its cause, the risk and the fix in plain English, with config you can paste.

  5. Report

    A results dashboard, PDF, HTML and text reports, and a badge you can embed.

Watching a payment page

  1. Fetch

    Up to four pages of one checkout, through the same guard. Only public addresses, only the site you named.

  2. Check in isolation

    Six checks (TLS, policy, headers, scripts and frames, cookies, payment forms) each run in their own process with time and memory limits.

  3. Fingerprint

    Each third-party script is downloaded once, as a visitor's browser would, and fingerprinted. If you switch it on and the server has it, a real browser also loads the page to find scripts created at runtime.

  4. Compare

    Scripts, frames and fingerprints are compared with the baseline you approved. The baseline lives in your browser and travels with the request. The server keeps nothing.

  5. Act

    You get a clear verdict, the fixes, ready headers, a policy that blocks anything unapproved, and an evidence pack for your bank or auditor.

What it does not do

  • It does not prove a site is secure. A clean result means these checks found nothing.
  • It does not run the site's JavaScript unless the real-browser check is available and switched on. It is off on the hosted site, so scripts created at runtime are not seen there.
  • It cannot watch your page while your browser is closed. Use the schedule it generates for round-the-clock checks.
  • It does not verify that you own a site unless you place the verification file shown in the payment guard.
  • It is an evidence helper, not a PCI DSS assessment or any other certification.