Running Your First Website Security Scan

Overview of the SiteSecura Assessment Engine#

SiteSecura is an external perimeter security scanner engineered to evaluate public web assets against modern defensive standards. Unlike active vulnerability exploitation tools or invasive penetration testing scripts, SiteSecura operates purely out-of-band as a passive client.

When you submit a domain or hostname for evaluation, our scanning nodes simulate a modern browser client and query your public network interfaces to determine whether your cryptographic certificates, defensive HTTP response headers, email authentication records, and domain routing conform to current industry benchmarks.

Passive Scanning vs Invasive Testing#

Understanding the difference between passive auditing and active penetration testing is critical:

• Non-Destructive Execution: SiteSecura sends standard HTTP GET and HEAD requests alongside authoritative DNS queries. We never inject SQL payloads, submit arbitrary form data, attempt credential brute-forcing, or stress-test application endpoints.
• Safe for Production Systems: Because requests follow normal user traffic patterns, running a scan will not trigger rate-limiting exhaustion, corrupt database state, or impact end-user performance.
• No Agent Installation Required: Scans evaluate what public adversaries and search engine crawlers can see from the public internet. You do not need to install local software agents or daemon processes on your web servers.

---

The 60-Second Scan Lifecycle#

When you trigger a scan from the SiteSecura homepage or your verified domain dashboard, the request moves through four coordinated phases orchestrated by Celery background worker tasks:

[1. Target Normalization] -> [2. Network & Safety Validation] -> [3. Parallel Audit Execution] -> [4. Scoring & Report Generation]

Phase 1: Target Normalization and URL Sanitization#

The engine accepts raw hostnames (e.g. example.com) or fully qualified URLs (e.g. https://example.com/app). The system strips redundant path parameters, resolves the base domain target, and checks against RFC 6761 reserved names.

Phase 2: SSRF and Safe-Network Validation#

To protect internal infrastructure and prevent Server-Side Request Forgery (SSRF), SiteSecura validates the target IP addresses prior to initiating any transport handshake. The engine rejects:

• Loopback addresses (127.0.0.0/8, ::1)
• Private RFC 1918 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Link-local and cloud metadata endpoints (169.254.169.254, fe80::/10)

Phase 3: Parallel Defensive Auditing#

Once approved, the target is dispatched across four isolated scanning modules executed in parallel:

1. SSL/TLS Handshake Module: Negotiates cryptographic parameters, validates certificate trust chains, checks hostname matching (SAN), and reads expiration timestamps.
2. HTTP Redirect & Transport Module: Evaluates port 80 cleartext behavior, verifies permanent 301 redirection to HTTPS, and detects downgrade vulnerabilities.
3. Defensive Response Headers Module: Inspects mandatory response headers including HSTS, Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options.
4. Authoritative DNS & Email Module: Queries public nameservers for SPF TXT records, DMARC policies, and DNSSEC signatures.

Phase 4: Scoring and Plain-English Report Generation#

Deduction penalties are applied to the baseline score (100 points), a final letter grade (A+ through F) is computed, and prioritized remediation recommendations are generated.

---

Step-by-Step: Running Your First Scan#

Follow this procedure to initiate your first audit:

1. Navigate to the Scan Launcher: Open the SiteSecura homepage or navigate to the Website Security Checker.
2. Enter Your Public Target: Type your domain (e.g., yourcompany.com) into the target input field. You do not need to include https:// or URL query strings.
3. Initiate the Audit: Click Run Security Scan.
4. Monitor Real-Time Progress: The progress indicator displays the execution status across all four audit modules.
5. Review the Security Grade and Report: Upon completion, you will receive an overall numeric score (0–100), an executive risk tier, and an itemized breakdown of pass/fail findings.

---

What a Scan Proves (and What It Does Not)#

It is essential to understand the technical boundary of a passive perimeter audit:

Important Distinction: A high SiteSecura score (e.g. 95/100, Grade A) proves that your public perimeter, encryption configurations, defensive response headers, and email authentication records are hardened against common opportunistic attacks. It does not prove that internal application logic, authenticated API endpoints, or database queries are free from zero-day vulnerabilities. Both perimeter hardening and secure software development lifecycle (SDLC) practices are essential.