How CheckWebSecurity Works
A transparent methodology for registering targets, validating cryptographic ownership, and executing non-destructive posture checks.
Step 1: Add your web target
Register your apex domain, host, or repository target. CheckWebSecurity builds an initial profile without running any intrusive tests.
- check_circle Stack profiling distinguishes CMS setups, framework deployments, and static sites.
- check_circle The free trial includes 1 full-featured website slot.
Architectural guardrail: adding a domain does not authorize scanning. No probes are initiated without cryptographic proof of ownership.
Step 2: Cryptographic ownership verification
Why verification is non-negotiable: unauthorized reconnaissance is a liability. Verification protects third-party hosting boundaries and guarantees assessments only run for real infrastructure owners.
Method A — DNS TXT
Insert a single TXT record at your domain host. Propagation is checked automatically.
Method B — HTTPS well-known file
Place a short verification token under /.well-known/ on your server — a zero-DNS alternative.
Step 3: Choose your assessment mode
Pick the mode that matches the access you have — or connect several for deeper coverage.
memory Host agent
Read-only agent on your Linux server for internal telemetry. Requires enrollment.
code Repository
Connect a repo for offline dependency and manifest analysis.
travel_explore External perimeter
Ownership-verified checks of your public endpoints — agentless.
info Unconfigured modules stay cleanly locked until you connect real credentials or tokens — we never render dummy progress spinners for integrations that aren’t yours.
Step 4: Execution & evidence redaction
Assessments run as rate-limited, read-only requests. No simulated progress bars or arbitrary percentages — each check produces real evidence.
- check_circle Probes are strictly bounded and back off rather than pressuring your origin.
- check_circle When findings include sensitive material, credentials and high-entropy values are redacted before the report is stored — server-side, at ingestion time.
Step 5: Plain-English remediation
Findings arrive with exact, copy-paste fixes so your team can act instead of researching.
- check_circle Pre-generated web server configs for Nginx and Apache.
- check_circle On-demand re-testing: apply a fix and verify the specific endpoint again.
From finding to fix, in one step
Every finding pairs the evidence with the exact server configuration that resolves it.
gpp_bad The finding — Critical
Your web server returns /.env over plain HTTP. Anyone could download the credentials inside it.
Evidence snippet (redacted at ingestion)
APP_NAME=ProductionCore
APP_ENV=production
APP_KEY=[REDACTED_HIGH_ENTROPY]
DB_CONNECTION=mysql
DB_PASSWORD=[REDACTED]build The fix — Nginx
Add to your server block and reload:
# Block hidden dotfiles except ACME challenges
location ~ /\.(?!well-known).* {
deny all;
return 404;
}A clean 404 instead of 403 avoids advertising that the file exists.
Complete engineering answers
Why can’t I scan arbitrary websites without proof of ownership?
Unrestricted scanning without authorization is unlawful reconnaissance in many jurisdictions. Cryptographic proof guarantees tests are only initiated by actual infrastructure owners, and zero third parties are probed without explicit permission.
Will automated checks degrade production latency or trigger 502 errors?
No. Assessment traffic is rate-limited and backs off on error responses. We strictly avoid invasive load testing, injection fuzzing storms, or bandwidth exhaustion tactics.
How does CheckWebSecurity protect sensitive credentials detected during assessments?
Redaction runs at ingestion time, server-side, before evidence is persisted: high-entropy values such as database passwords, private keys, and API tokens are replaced with masks before the report ever reaches storage, dashboards, or notifications.
Do I need to install anything on my server?
Only for host-agent telemetry, which is optional. External perimeter checks and repository analysis require no server installation at all — just verified ownership.
Evaluate your production perimeter
Register your target and review your first findings — with zero obligation.
rocket_launch Start 7-Day Free Trial