usefulweb.site Security Configuration Scanner

Security & supply-chain explorers

Security Configuration Scanner

Passive, graded check of a domain's TLS, security headers, DNS security and security.txt.

Required for live scans.

Try an example: Offline review of pasted findings

How it works

For a domain you are authorised to test, checks the live TLS certificate, HTTP security headers, HTTP→HTTPS redirect, DNSSEC (validated via Google Public DNS), CAA, SPF and DMARC, and /.well-known/security.txt (RFC 9116 Contact and Expires), then grades the result and lists concrete fixes. Passive single requests only. You can also paste headers, DNS records and a certificate summary for an offline review, including cookie flags.

  • Only scan systems you own or are authorised to test. This scanner is passive: a handful of ordinary single requests (the home page over HTTPS and HTTP, /.well-known/security.txt, public DNS and one TLS handshake) and no probing, fuzzing or port scanning.
  • TLS + DNS: the DNS + Certificate Explorer is called once (resolver lookups of TXT/CAA/_dmarc and one TLS handshake on port 443, no CT search). Certificate findings: trust, hostname match, expiry (<14 days = warning), RSA key size, TLS 1.0/1.1.
  • DNSSEC: one query to the Google Public DNS JSON API (dns.google/resolve, do=1); AD=true means the answer was DNSSEC-validated.
  • Headers: one GET of https://<domain>/ analysed with HeaderLens rules (HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, Permissions-Policy, version disclosure). Redirect: one GET of http://<domain>/; pass if it ends on https://.
  • security.txt (RFC 9116): Contact and Expires are required; Expires must be in the future, ideally less than a year ahead; served as text/plain.
  • Cookies: only checked from pasted headers (the live fetcher strips Set-Cookie). Only cookie names and flags are reported, never values.
  • Score: 100 minus 20 per high, 8 per medium, 3 per low finding; A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, else F; any high finding caps the grade at C.

Only scan systems you own or are authorised to test. This scanner is passive: a handful of ordinary single requests (the home page over HTTPS and HTTP, /.well-known/security.txt, public DNS and one TLS handshake) and no probing, fuzzing or port scanning.

For scripts and AI agents

  • JSON API: POST https://securityconfigurationscanner.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://securityconfigurationscanner.usefulweb.site/mcp · tool name security_configuration_scanner
Example request
curl -s -X POST https://securityconfigurationscanner.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

  • DNS + Certificate Explorer – DNS records, e-mail security, CAA, live TLS certificate and CT history for a domain.
  • HeaderLens – Is a website down? Multi-region status, redirects, TLS and security headers.
  • OAuth Permission Explorer – What an OAuth consent request really allows: scopes, risky combinations and flow problems.
Feedback