1.TLS/SSL Versions
Checks for outdated/vulnerable protocols like SSL 3.0, TLS 1.0, TLS 1.1.
2.SSL Certificate
Validity, expiration, chain trust, hostname match, key size, signature algorithm.
3.Security Headers
HSTS, X-Content-Type-Options, X-Frame-Options, CSP, X-XSS-Protection, etc.
4.Insecure Server Configuration
TRACE method, server banner disclosure, directory listing, WebDAV, etc.
5.Open Ports
Scans for risky/unnecessary open ports like FTP, SSH, databases, RDP, etc.
6.Firewall Rules (Inferred)
Analyzes whether high-risk ports are properly restricted.
7.DNS Zone Transfer
Checks if AXFR zone transfers are allowed.
8.Vulnerable Software
Detects outdated versions of Apache, nginx, IIS, PHP, OpenSSL, etc. via banners.
9.Sensitive Files Exposed
Publicly accessible files like web.config, .env, wp-config.php, phpinfo.php, backups, admin panels.
10.HTTP Security Issues
Insecure cookies, mixed content, open redirects.
11.Exposed Management Interfaces
phpMyAdmin, cPanel, Plesk, Webmin, WHM, DirectAdmin, WordPress admin, Tomcat, etc.
12.Exposed API Keys
Scans page source for leaked AWS, Google, Stripe, GitHub, Slack, SendGrid, Twilio keys, and private keys.
13.Clickjacking Protection
Verifies X-Frame-Options or CSP frame-ancestors prevent your site from being framed by attackers.
14.Cookie Security
Checks Set-Cookie headers for Secure, HttpOnly, and SameSite flags required for PCI compliance.
15.Error Disclosure
Probes for verbose error pages leaking stack traces, file paths, or framework internals.
16.Cloud Storage Exposure
Probes predictable AWS S3, Google Cloud Storage, and Azure Blob URLs for publicly listable buckets.
17.OAuth/OIDC Security
Probes the OpenID Connect discovery endpoint for weak signing algorithms and missing PKCE support.
18.PII Detection
Scans homepage source for exposed credit card numbers (Luhn-validated), SSN patterns, and email harvesting risk.
19.Weak Cryptography
Detects references to MD5, SHA-1, DES, RC4, and insecure JS patterns like Math.random for tokens.
20.Admin Panel Discovery
Probes common admin paths (/admin, /wp-login, /manager, etc.) for exposed login forms that should be IP-restricted.
21.CORS Misconfiguration
Sends a crafted Origin header to see if the server reflects arbitrary origins or combines wildcard with credentials - a classic cross-site data leak.
22.WebSocket Security
Scans page references for ws:// (unencrypted) versus wss:// (TLS) WebSocket endpoints. Plain ws:// traffic is readable on the wire.
23.CSRF Token Presence
Inspects POST forms on the homepage for a hidden anti-forgery token field. Forms without tokens may allow cross-site request forgery.
24.JSON Hijacking
Samples linked JSON/API endpoints for top-level arrays without anti-hijack guards - an older but still-exploitable class of bug.