Web Security Check

Checks your web server's security configuration: HTTPS enforcement, security headers, exposed ports and version leaks.

Check	What is checked
HTTPS	Is the site reachable via HTTPS, and are HTTP requests redirected?
HSTS	Strict-Transport-Security with a sufficient max-age (≥ 1 year ok, < 1 day warn)?
CSP	Is there a Content Security Policy? unsafe-inline/unsafe-eval or wildcards weaken it (warn).
Security headers	X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — if three or more are missing ⇒ warn.
Server info	Do Server or X-Powered-By headers reveal concrete version numbers? Versions make targeted attacks easier (warn).
Open ports	TCP connection attempts on 80/443/8080/8443 (web) and 22/3306/5432/6379/27017 (sensitive). Publicly reachable database or SSH ports ⇒ warn.
robots.txt / security.txt	Are the two standard files present? Content is displayed (info).

CVE lookup (verified domains)

For domains whose ownership you have verified in the workspace, Vernax additionally matches a detected server version (e.g. nginx/1.24.0) against the NVD vulnerability database: known CVEs are listed, critical or high severities lead to fail.