Webcuris

Running a scan

Scanning a website

The standard pass: thirty-two checks that need nothing more than an ordinary browser would do.

What a standard scan is

A standard scan runs against any address you give it, verified or not. Every check in it does something an ordinary visitor's browser already does — request a page, read the response headers, resolve DNS, look at the certificate, load the scripts the page references.

That is the reason it is safe against production and the reason it needs no permission beyond your own. Nothing is written, nothing is exploited, and no request is sent that a visitor would not have sent.

The website scan form, with the address field and the list of checks that will run.
Recon → Scan a website. The full check list is shown before the scan starts.

What it checks

The standard pass covers transport, headers, DNS and mail, the front-end supply chain, and the surface a site exposes without meaning to.

  • Transport and certificates — TLS configuration, plain-HTTP upgrade, mixed content, certificate and domain lifecycle.
  • Headers — Content-Security-Policy, cookie attributes, CORS, caching, and the modern header set graded rather than counted.
  • DNS and mail — records, subdomain discovery, subdomain takeover, and the complete email-security set including MTA-STS, TLS-RPT, DKIM selector discovery and BIMI.
  • Supply chain — third-party scripts and their integrity, vulnerable JavaScript libraries, exposed source maps, client bundle analysis.
  • Exposure — API surface, OIDC discovery, observable JWTs, information leakage, cloud storage referenced by the page.
  • Reputation and integrity — blacklist status, lookalike domains, malware and defacement checks.
  • Platform — technology fingerprinting, CMS-specific surface, WordPress plugins and their known CVEs.

Rendered in a real browser

One check loads the page in headless Chromium rather than reading the HTML the server first returned. A single-page application often has no meaningful HTML until JavaScript has run, so a scanner that only reads the first response is assessing a loading screen.

The renderer runs inside Chromium's own sandbox. Where the host cannot provide one, the check reports itself unavailable rather than running unsandboxed.

How long it takes

Usually under two minutes. Almost all of that is waiting on the target — DNS, TLS negotiation, and rendering. Checks run in waves, so one slow lookup does not hold up the rest.