# Security Configuration Scanner

> Passive, graded check of a domain's TLS, security headers, DNS security and security.txt. For a domain you are authorised to test, checks the live TLS certificate, HTTP security headers, HTTP→HTTPS redirect, DNSSEC (validated via Google Public DNS), CAA, SPF and DMARC, and /.well-known/security.txt (RFC 9116 Contact and Expires), then grades the result and lists concrete fixes. Passive single requests only. You can also paste headers, DNS records and a certificate summary for an offline review, including cookie flags.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://securityconfigurationscanner.usefulweb.site/ (interactive tool at https://securityconfigurationscanner.usefulweb.site/tool)
- JSON API: POST https://securityconfigurationscanner.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://securityconfigurationscanner.usefulweb.site/api/v1/tool)
- OpenAPI: https://securityconfigurationscanner.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://securityconfigurationscanner.usefulweb.site/mcp - tool `security_configuration_scanner`

## Inputs
- domain (text, required): Domain
- mode (select): Mode
- authorized (boolean): I own this domain or am authorised to test it - Required for live scans.
- headers (textarea): Pasted: HTTP response headers
- dnsRecords (textarea): Pasted: DNS records
- certificate (textarea): Pasted: certificate summary
- securityTxt (textarea): Pasted: security.txt content
- httpsRedirect (select): Pasted: does http:// redirect to https://?

## Method
- Only scan systems you own or are authorised to test. This scanner is passive: a handful of ordinary single requests (the home page over HTTPS and HTTP, /.well-known/security.txt, public DNS and one TLS handshake) and no probing, fuzzing or port scanning.
- TLS + DNS: the DNS + Certificate Explorer is called once (resolver lookups of TXT/CAA/_dmarc and one TLS handshake on port 443, no CT search). Certificate findings: trust, hostname match, expiry (<14 days = warning), RSA key size, TLS 1.0/1.1.
- DNSSEC: one query to the Google Public DNS JSON API (dns.google/resolve, do=1); AD=true means the answer was DNSSEC-validated.
- Headers: one GET of https://<domain>/ analysed with HeaderLens rules (HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, Permissions-Policy, version disclosure). Redirect: one GET of http://<domain>/; pass if it ends on https://.
- security.txt (RFC 9116): Contact and Expires are required; Expires must be in the future, ideally less than a year ahead; served as text/plain.
- Cookies: only checked from pasted headers (the live fetcher strips Set-Cookie). Only cookie names and flags are reported, never values.
- Score: 100 minus 20 per high, 8 per medium, 3 per low finding; A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, else F; any high finding caps the grade at C.

## Limits
- Only scan systems you own or are authorised to test. This scanner is passive: a handful of ordinary single requests (the home page over HTTPS and HTTP, /.well-known/security.txt, public DNS and one TLS handshake) and no probing, fuzzing or port scanning.