Does the scan attack or probe my website?

No. We open the homepage once like a normal browser, plus the public security.txt file. No port scans, no login attempts, no searching for hidden files.

What grade should I aim for?

A or A+. Most problems are fixed with a few lines in your web server, CDN or hosting settings.

My hosting provider manages the server. What now?

Send them the report link. Every finding includes the exact setting to change.

How secure is your website?

Get an A–F grade for HTTPS, security headers, cookies and visible software versions, with a fix for every finding.

HTTPS and certificate

Valid certificate, days until it expires, redirect from http to https and whether old TLS versions are still accepted.

Security headers

HSTS, Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer- and Permissions-Policy.

Cookies

Whether cookies have the Secure, HttpOnly and SameSite flags.

Visible software versions

Server, framework or CMS versions that tell attackers what to look for.

Mixed content

Scripts or frames that are loaded without encryption on a secure page.

security.txt

Whether people who find a problem know where to report it.

Questions

Does the scan attack or probe my website?: No. We open the homepage once like a normal browser, plus the public security.txt file. No port scans, no login attempts, no searching for hidden files.
What grade should I aim for?: A or A+. Most problems are fixed with a few lines in your web server, CDN or hosting settings.
My hosting provider manages the server. What now?: Send them the report link. Every finding includes the exact setting to change.

OZAG Technologies · KVK 42167370 · Laan van Oversteen 20, 2289 CX Rijswijk · +31 6 24496620 · support@ozagsecurity.com