Security Scans
Scan a site on a schedule for the mistakes that leak secrets or weaken it: exposed files, missing security headers, insecure cookies, mixed content, directory listings and common injection flaws.
What the scan does
A Security scan monitor loads the URL you give it with a GET request, following up to 5 redirects, and examines the response. What it does next depends on Scan type:
| Scan type | What it sends |
|---|---|
| Full scan | Everything a passive scan does, plus a handful of test requests to the URL: a SQL injection probe (?id=1' OR '1'='1), a harmless HTML tag in q and search to look for reflected XSS, redirect parameters pointing at another site, and an OPTIONS request from a foreign Origin to test CORS. Nothing is written or changed; the probes only read what comes back. The default. |
| Passive scan | The page, then a request for each of a few files that should never be public. It reads only what any visitor could. |
| Headers only | The page and nothing else. Every finding below comes from that one response, except exposed files and the Full scan probes. |
Each problem it finds is a finding, with a severity of Critical, High, Medium, Low or Info. The monitor goes down for a finding at or above Minimum severity to alert (Medium by default), or when the page can't be loaded at all. Findings below that severity are still listed on the monitor page and lower the grade, but the monitor stays up.
Findings
| Finding | Severity | Raised when |
|---|---|---|
| Sensitive file exposed | Critical | Full and passive scans. One of .env, .git/config, wp-config.php.bak or .DS_Store, requested next to the URL you entered, answers 200 with a non-empty body that isn't an HTML page. Each request is given 2 seconds. |
| SQL Injection (SQLi) | Critical | Full scan. The injection probe's response contains a database error (SQL syntax, mysql_fetch, ORA-). |
| Cross-Site Scripting (XSS) | High | Full scan. The test tag sent in the query string comes back unescaped in the page. |
| CORS Misconfiguration | High | Full scan. The server answers a request from a foreign origin with that origin in Access-Control-Allow-Origin. |
| Open Redirect | Medium | Full scan. The server redirects to the foreign site named in next, returnTo or url. |
| Cookie without Secure flag | Medium | The response sets a cookie without Secure or without HttpOnly. One finding covers all such cookies, with the count. |
| Mixed content | Medium | An https:// page has src or href attributes pointing at http:// addresses — plain links included. One finding, with the count. |
| Directory listing enabled | Medium | The page's title starts with Index of /, the server's automatic listing of a folder. |
| Missing Strict-Transport-Security | Low | The response has no Strict-Transport-Security header. |
| Missing Content-Security-Policy | Low | The response has no Content-Security-Policy header. |
| Missing X-Frame-Options | Low | The response has no X-Frame-Options header. |
The files are requested relative to the URL you entered: for https://example.com that is https://example.com/.env; for https://example.com/app, https://example.com/app/.env. Scan the bare domain to cover the site root.
Hardening checks
Each scan also runs a checklist against the same response. These are shown pass or fail on the monitor page and never change the monitor's status on their own:
| Check | Passes when |
|---|---|
| TLS configuration | The URL you entered starts with https://. |
| Security headers | All six are present: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Otherwise it says how many are missing. |
| Content-Security-Policy | The header is present. |
| Strict-Transport-Security | The header is present. |
| Mixed content | No http:// references on an https:// page. |
| Cookie flags | Every cookie set has Secure and HttpOnly, or none is set. |
| Software disclosure | There is no X-Powered-By header, and the Server header carries no version number. |
| Directory listing | The page isn't an Index of / listing. |
Each selected region runs its own scan, and the results are combined as described in Core Concepts.
Create a security scan monitor
- 1Choose the type
On the Monitors page, click New, open the type picker and choose Security scan monitor. It is listed under Security & certificates.
- 2Enter the target
Fill in Target URL or hostname with the site to scan, such as
https://example.com. A bare hostname likeexample.comis scanned overhttps://. To scan a plain-HTTP site, enterhttp://yourself. - 3Choose the scan
Open Advanced settings. Under Scan settings, pick the Scan type (see above) and Minimum severity to alert — Low, Medium, High or Critical. If the site is behind a login prompt or expects a header, fill in HTTP authentication or Request headers: they are sent with the page request and every request after it.
- 4Set the timeout and frequency
Under Advanced settings, Request timeout in Request parameters (30 seconds by default; 10 to 60) is how long the page itself may take to load. Check frequency defaults to 3 minutes; a site's headers and files change only when you deploy, so
30 minutesis usually plenty. - 5Create it
Pick who is alerted under How should we escalate incidents? and click Create monitor.
When it goes down
| What happened | Message on the check |
|---|---|
| A finding at or above the minimum severity — here an exposed file | 4 findings (1 critical, 3 low). Worst: Exposed Sensitive File. |
| The page couldn't be loaded | Scan Error: followed by the reason — for example a name that doesn't resolve, a refused connection, a timeout or an invalid certificate. |
The message counts every finding by severity and names the worst, so a scan that stays up reads the same way — 3 findings (3 low). Worst: Missing Header: strict-transport-security. for three missing headers, and No findings. for a clean scan. An error status from the page itself, such as 404 or 500, doesn't fail the scan: the response is examined all the same.
The monitor stays down, with its incident open, until a scan finds nothing at or above the minimum severity. Remove or block the exposed file and the next scan closes the incident.
.env or .git/config may already have been downloaded by others. Block it, then change every password, key and token it held.The monitor page
- The bar at the top: the target, the number of URLs scanned, and CLEAN or how many findings the last scan had.
- In the monitor list, the row shows how many issues the last scan found and the worst severity among them. It reads red when the monitor is down or the worst finding is Critical or High, and amber for lesser findings.
- Findings over time: the number of findings per scan, with the latest Critical, High and Medium counts.
- SECURITY GRADE: a letter from the worst finding —
Ffor any Critical,Dfor High,Cfor Medium,Bfor Low,Afor none — and a score out of 100 that loses 25 per Critical, 10 per High, 5 per Medium and 2 per Low. It also shows Checks passed and the counts by severity. - Hardening checks: the checklist above, with how many passed and a short result for each.
- Findings: every finding from the latest scan, worst first, with its Severity, Issue, Category, Target and Date. Expand a row for the CVSS score, CWE and OWASP references, where it was found, how long it has been turning up, and the fix — for a missing header, the header to add.
- Security headers: each of the six headers with its value (or Present for a long one), Missing or Not set.
Troubleshooting
The scan fails with a certificate error
The scan only reads sites whose certificate is valid for the hostname. Fix the certificate — an SSL certificate monitor shows exactly what the server presents — or scan the http:// address instead.
A sensitive file is reported but the site has none
Some servers answer every unknown path with 200 and a plain-text or empty-looking page instead of a 404. Open the file the finding names — its Detail reads, for example, Found accessible file at /.env — in a browser. If it isn't the real file, make the server return 404 for paths that don't exist.
The headers I added don't show up
The scan reads the headers of the response to your URL after redirects. If a CDN or proxy sits in front of your server, make sure it passes them through, then wait for the next scan.