Detailed TLS test · 18 checks · report in plain English

Test of TLS, HSTS and security headers.

TLS 1.3, certificate and its chain, HSTS preload, CSP evaluation, X-Frame-Options, Permissions-Policy, Referrer-Policy. Same checks as Mozilla Observatory, but with European context.

Passive scan · no signup · results in 30 seconds

https://

Scan takes 30 seconds. You can request the PDF report with a button on the results page.

How it works

3 steps · 30 seconds

Enter the site address

No signup and no cookie banner. Enter the address and see the result.

We run checks

TLS handshake, certificate chain, HSTS, CSP, header evaluation. 18 checks total.

Detailed report

For each finding you'll see a link to the RFC, the exact value and, if it's missing, the recommended configuration.

What the full scan tests

Same checks as Mozilla Observatory and SecurityHeaders.com, plus things specific to the European market (SPF with local providers).

TLScritical

TLS 1.0 / 1.1 still enabled

These versions have been outdated since 2020 and violate PCI-DSS.

openssl s_client -tls1_1 → handshake OK

HSTScritical

HSTS missing

Without Strict-Transport-Security the first request always goes over HTTP. An sslstrip attack on public Wi-Fi is then trivial.

Strict-Transport-Security: (missing)

HSTSwarning

HSTS without preload

max-age is set, but the domain is not in the Chrome HSTS preload list. We recommend max-age=31536000 + includeSubDomains + preload.

STS: max-age=300 (too low for preload)

CSPwarning

CSP uses unsafe-inline

default-src 'self' 'unsafe-inline' effectively disables XSS protection. We recommend switching to CSP with a nonce.

CSP: default-src 'self' 'unsafe-inline'

Headerswarning

X-Frame-Options missing

Without this header the page can be embedded in an iframe and abused for clickjacking. A modern alternative is CSP with the frame-ancestors directive.

X-Frame-Options: (missing)

TLScritical

Certificate does not match the domain

The browser shows a blocking warning because the hostname is not covered by the certificate.

CERTIFICATE_VERIFY_FAILED: hostname mismatch

About Vulscan

We like Mozilla Observatory, but felt it lacked European context: what to tell a customer hosting with a regional provider or in the cloud. This test is technical, but mindful of who'll have to fix it.

hello@vulscan.app LinkedIn

Passive scan

No invasive tests. We behave like an ordinary visitor, and your site won't notice the check.

European context

We know local hosting providers, CMSes and registrars, so our recommendations are specific.

Real help

If you don't understand a finding, write to us. We'll answer.

Frequently asked questions

How does it differ from Mozilla Observatory?+

Same basic rating, plus an SPF check with local providers (Smartemailing, Mailkit) and plain-English recommendations.

Do you have an API?+

We have a private API for our partners. If you'd like to use it, get in touch and we'll work it out.

Is the scan safe? Won't it damage the site?+

Yes. The scan is passive and behaves like an ordinary visitor. We don't try exploits, crack passwords or send attack requests. Your site won't notice the check.

What do you do with the data? Where do results go?+

You see the most serious findings on the site right away. You can email yourself the full PDF report with one click. We keep your email so we can alert you if a new serious finding appears on your domain. You can unsubscribe at any time.

What if you find a critical problem?+

You'll get a report where every problem is explained with a concrete remediation step. Most things your webmaster can handle. If not, write to us. We're happy to take a look.

Run the full test of TLS and security headers.

No email and no signup. Enter the address and you'll see the result. You can then have the PDF report sent to your email.