Security Scanner

A web security scanner examines a website's security posture across multiple dimensions: SSL/TLS configuration (certificate validity, protocol versions, cipher suites), HTTP security headers (CSP, HSTS, X-Frame-Options, etc.), cookie security attributes, mixed content, HTTPS redirect behaviour, and information disclosure (server version headers, directory listings). It gives a high-level security rating and highlights specific areas that need remediation.

A TLS downgrade attack occurs when an attacker intercepts the TLS handshake between a client and server and manipulates it to force both parties to use an older, weaker protocol version (like SSLv3 or TLS 1.0) or weaker cipher suite that the attacker can then break or exploit. Mitigations include disabling support for old protocol versions (only TLS 1.2 and 1.3 should be enabled), implementing HSTS, and using the TLS_FALLBACK_SCSV signal.

A cipher suite is a combination of algorithms used during a TLS connection for key exchange, authentication, encryption, and message authentication. Examples: TLS_AES_256_GCM_SHA384 (TLS 1.3) or ECDHE-RSA-AES256-GCM-SHA384 (TLS 1.2). Weak cipher suites using RC4, DES, 3DES, or MD5 can be broken by modern attacks. Only suites with forward secrecy (ECDHE or DHE key exchange) and authenticated encryption (GCM or CHACHA20-POLY1305) should be enabled.

Forward secrecy (also called Perfect Forward Secrecy or PFS) is a TLS property where each connection uses a unique, ephemeral session key that is not derived from the server's long-term private key. If an attacker records encrypted traffic today and later compromises the server's private key, they still cannot decrypt the recorded traffic — because the session keys were temporary and are no longer available. Forward secrecy is enabled by using ECDHE or DHE key exchange algorithms in your cipher suites.