Our scanning methodology

We think a security tool should be completely transparent about what it does. Here is exactly what ScanOpsPro checks, how the score is built, and — just as important — what it does not do.

In short

Every scan reads only your site’s live, public response: TLS certificate, HTTP headers and timing. We never send attacks, never log in, and never publish a report about a site unless someone runs a scan for it. If a check can’t run, we report it as unknown rather than guessing.

What we check

A scan opens a normal HTTPS connection to your site — the same kind your browser makes — and evaluates the response. Each check is weighted by its real-world security or performance impact.

Group	Check	What it looks for	Weight
Encryption & TLS	HTTPS with a valid certificate	A verifiable TLS certificate and HTTPS delivery	20
	HTTP redirects to HTTPS	Whether the plain `http://` version forces HTTPS	12
	Modern TLS protocol	Negotiated TLS 1.2 or 1.3 (and cipher)	8
	Certificate not expiring soon	Days remaining before the certificate expires	6
Security headers	HSTS	Strict-Transport-Security header forcing HTTPS	14
	Content-Security-Policy	A CSP header to mitigate cross-site scripting	12
	Clickjacking protection	X-Frame-Options or CSP `frame-ancestors`	8
	X-Content-Type-Options	`nosniff` to stop MIME sniffing	8
	Referrer-Policy	Control over referrer data leakage	6
	Permissions-Policy	Restricting camera, microphone, geolocation, etc.	4
Performance	Time To First Byte	Measured server response time	12
	Text compression	Brotli or Gzip content-encoding	6
	Modern HTTP protocol	HTTP/2 or HTTP/3 support	4
DNS & email	SPF record	A published SPF record limiting who can send email as your domain	5
DNS & email	DMARC record	A DMARC policy protecting against email spoofing	5
Server hygiene	Server version not disclosed	Whether the Server header leaks a version	4
	No technology fingerprint	Whether X-Powered-By exposes the stack	3
	Cookie flags	Secure and HttpOnly on any cookies set	5
	security.txt	A /.well-known/security.txt vulnerability-disclosure file	2

Checks are grouped into Encryption & TLS, Security headers, Performance, DNS & email and Server hygiene — up to 19 checks in all. Your score is the percentage of available points your site earned on that scan. Checks that can’t apply or can’t be completed — cookie flags on a site that sets no cookies, or an email record we couldn’t look up — are simply left out rather than counted against you. A score above 85 is Strong, 60–84 is Needs work, and below 60 is At risk.

What we deliberately don’t do

No intrusive testing. We never send exploit payloads, brute-force logins, or probe endpoints behind authentication. Every check uses information your server already broadcasts publicly.
No fabricated reports. We do not pre-generate audits of banks, universities, government sites or anyone else. A report only exists when a scan is run.
No invented numbers. If we cannot measure something — because a site is down, blocks automated requests, or the check doesn’t apply — we mark it unknown instead of filling in a plausible-looking value.
No SEO link schemes. Outbound links on this site are ordinary editorial links; we don’t sell or manipulate them.

A scan is a starting point, not a certificate. A high score means your site handles the fundamentals well on the checks we run. It is not a guarantee of security, a penetration test, or a compliance certification. For anything high-stakes, follow up with a professional audit.

How to read your results

Fix failing checks in weight order — the heaviest failing item is usually the best use of your time. Our guide on how to read a website security scan walks through a full example, and the guides library explains every check in depth.

Try it on your own site

The scan is free, takes a few seconds, and needs no signup.

Run a scan