What Hexora scans for
Seven security scanners run in parallel to give you a complete picture in under 15 seconds.
SSL/TLS Configuration
Analyses your SSL/TLS setup using sslyze, the industry-standard TLS testing library. Checks for expired or weak certificates, deprecated protocol versions (SSLv3, TLS 1.0, TLS 1.1), weak cipher suites, missing certificate chain elements, and HSTS configuration.
Security Headers
Checks for the presence and correct configuration of HTTP security headers that protect against common web attacks. Includes Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin headers (COOP, COEP, CORP).
CORS Policy
Evaluates your Cross-Origin Resource Sharing configuration for overly permissive policies that could allow unauthorised cross-origin access. Detects wildcard origins, credential exposure, and misconfigured preflight responses.
Cookie Security
Inspects cookies set by your application for missing security attributes. Checks for the Secure flag (HTTPS-only), HttpOnly flag (prevents JavaScript access), SameSite attribute (CSRF protection), and overly broad domain or path scoping.
Exposed Secrets & Sensitive Files
Probes for accidentally exposed sensitive files that should not be publicly accessible. Checks for environment files (.env), Git configuration, backup files, and other common deployment mistakes. Uses baseline detection to avoid false positives from SPAs and CDNs.
DNS & Email Authentication
Validates your domain's email authentication records to prevent spoofing and phishing. Checks for SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), DMARC (Domain-based Message Authentication), and MX record configuration. Subdomain scans provide contextual results noting that these records are typically configured at the root domain.
Technology Fingerprinting
Identifies the technologies, frameworks, and services your site is running. Detects web servers, JavaScript frameworks, CMS platforms, CDN providers, and analytics tools. Helps you understand your exposure and whether any detected technologies have known security considerations.