Security Shield: website security check
What the scanner checks in eight areas, how to read the A–F rating, why to verify the domain, what auto-fix can do, and what the check does not replace.
Security Shield — a service for checking website security. It looks at the site from the outside, as an attacker would, and shows what can be improved.
What is checked
| Direction | What we check |
|---|---|
| Security headers | HSTS, Content-Security-Policy, protection against clickjacking and content type spoofing |
| Encryption | Presence of HTTPS and redirection to it, validity and validity period of the certificate, outdated TLS versions |
| Data leaks | Open service files and folders, backups, debug pages, software versions in headers |
| Cookies and CORS | Secure, HttpOnly, and SameSite flags, overly broad cross-domain access rules |
| CMS and components | Outdated versions, known vulnerabilities of components, open panels and registration |
| Active probes | Reflected XSS, signs of SQL injections, open redirects |
| Mail and DNS | SPF, DMARC, DNSSEC, CAA, risk of subdomain hijacking |
| Malicious code | Skimmer scripts, miners, hidden frames, spam links, domain blacklisting |
What Shield does not do
This is an external check: it does not replace a full code audit and pentest. There is no separate CSRF check in the scanner — part of the risks of this class is indirectly reflected in the cookie flags check.Rating A–F
As a result of the scan, the site receives a letter grade and a list of findings with severity levels. The findings are accompanied by classification according to commonly accepted standards and a clear explanation of what this threatens and how to fix it.
Domain verification
A quick check is available for any site. Deep scans require verification that the site is yours: via a DNS record, a file in the root, or a meta tag. This protects against using the service to scan other resources.
What to do with the result
- Auto-fix — the service will generate a ready-made server configuration snippet or a list of DNS records for the identified issues.
- Monitoring — subscription to regular checks to learn about a problem before visitors do.
- Server agent — an optional script for checking files from the inside, looking for signs of infection.
FAQ
Does Shield check for CSRF protection?
There is no separate CSRF check in the scanner. Part of the risks of this class is indirectly reflected in the cookie flags check, particularly SameSite.
Why verify the domain?
Deep scans are only possible for your own sites — verification protects against using the service against other resources.
Does this replace a pentest?
No. This is an external automated check; it does not replace code audit and manual penetration testing.
Try it on your project
Everything described in the article is available in the dashboard — the registration bonus is already in your balance.
Open dashboard
Was this article helpful?
Thank you! We will consider this in future updates.