Question 1

Which HTTP security headers does WebAudit check?

Accepted Answer

WebAudit checks Content-Security-Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. It also detects CORS wildcard misconfigurations, missing Cross-Origin-Opener-Policy / Cross-Origin-Embedder-Policy headers, and server version disclosure in response headers.

Question 2

What TLS and SSL checks does the scanner run?

Accepted Answer

The scanner validates the TLS certificate chain, checks the expiry date (flagging certificates expiring within 60 days), detects self-signed certificates, identifies weak protocol versions, and reports the cipher suite in use. Expired certificates deduct 30 points from your score; certificates expiring within 14 days deduct 20 points.

Question 3

How do I check SPF, DMARC, and DKIM for my domain?

Accepted Answer

Paste your domain URL into the scanner and WebAudit will automatically query DNS for your SPF record, DMARC policy, DKIM public key (testing 12 common selectors), CAA records, and DNSSEC delegation. Results appear in the DNS Security section of the scan report with specific fix recommendations for any missing or weak records.

Question 4

Do I need an account to scan a website?

Accepted Answer

No account is needed for the free scan. Paste a URL, click Scan, and get results instantly. Pro features — full cookie analysis, cross-origin isolation checks, PDF report export, and API access — require a Pro subscription (₹499/month in India, $7/month internationally). A one-time scan is also available for ₹99 if you only need a single full report.

Scan Website Security

Scan Failed

Scan Website Security

Scan Failed

↓ Download PDF Report

↗ Share Report