Deep TLS test · 18 checks · plain-English report

Test of TLS, HSTS and security headers.

TLS 1.3, certificate and its chain, HSTS preload, CSP evaluation, X-Frame-Options, Permissions-Policy, Referrer-Policy. Same checks as Mozilla Observatory — but with European context.

Passive scan · no signup · results in 30 seconds

https://

Scan takes 30 seconds. You can request the PDF report with a button on the results page.

How it works

3 steps · 30 seconds

Enter a URL

No signup. No cookie banner. Just URL → result.

We run checks

TLS handshake, certificate chain, HSTS, CSP, header evaluation. 18 checks total.

Detailed report

For each finding you'll see a link to an RFC, the exact value and — if missing — recommended configuration.

What the full scan tests

Same checks as Mozilla Observatory and SecurityHeaders.com, plus things specific to the European market (SPF with local providers).

TLScritical

TLS 1.0 / 1.1 still enabled

These versions have been outdated since 2020 and violate PCI-DSS.

openssl s_client -tls1_1 → handshake OK

HSTScritical

HSTS missing

Without Strict-Transport-Security the first request always goes over HTTP. An sslstrip attack on public Wi-Fi is then trivial.

Strict-Transport-Security: (missing)

HSTSwarning

HSTS without preload

max-age is set, but the domain is not in the Chrome HSTS preload list. We recommend max-age=31536000 + includeSubDomains + preload.

STS: max-age=300 (too low for preload)

CSPwarning

CSP uses unsafe-inline

default-src 'self' 'unsafe-inline' effectively disables XSS protection. We recommend switching to CSP with a nonce.

CSP: default-src 'self' 'unsafe-inline'

Headerswarning

X-Frame-Options missing

Without this header the page can be embedded in an iframe and abused for clickjacking. A modern alternative is CSP with the frame-ancestors directive.

X-Frame-Options: (missing)

TLScritical

Certificate does not match the domain

The browser shows a blocking warning because the hostname is not covered by the certificate.

CERTIFICATE_VERIFY_FAILED: hostname mismatch

12,480

Header tests this month

78%

Domains without proper CSP

31%

Domains without HSTS

About Vulscan

We like Mozilla Observatory, but felt it lacked European context — what to tell a customer hosting with a regional provider or in the cloud. This test is technical, but mindful of who'll have to fix it.

hello@vulscan.app LinkedIn

Passive scan

No invasive tests. We behave like a visitor — your site won't notice we're there.

European context

We know local hostings, CMSes and registrars. Recommendations are concrete, not generic.

Real help

If you don't understand a finding, write us — a human replies, not a bot.

Frequently asked questions

How does it differ from Mozilla Observatory?+

Same basic rating, plus an SPF check with local providers (Smartemailing, Mailkit) and plain-English recommendations.

Do you have an API?+

We have a private API for our partners. If you'd like to use it, get in touch and we'll work it out.

Is the scan safe? Won't it damage the site?+

Yes. The scan is passive — it behaves like an ordinary visitor. We don't try exploits, don't crack passwords, don't send invasive payloads. The site won't notice we're there.

What do you do with the data? Where do results go?+

You'll see the results right on the site and can then email yourself the PDF report with one click. We keep your email so we can alert you if a new serious finding appears on your domain. You can unsubscribe at any time.

What if you find a critical problem?+

You'll get a report where every problem is explained with a concrete remediation step. Most things your webmaster can handle. If not, write us — we're happy to take a look.

Run the full test of TLS and security headers.

No email, no signup. Just a URL and you'll see the result. You can then request the PDF report by email.