Security scans

A security scan is an on-demand health check for the security of one of your websites. TLDTrack points a dedicated cloud scanner at your site, checks it the way an attacker's tools would, and hands you back a plain-English report of what is exposed, why it matters, and how to fix it.

What a scan actually checks

A single scan runs a battery of independent checks and rolls every result into one report. The main areas it covers:

• HTTP security headers. Whether your site sends the protective headers browsers rely on: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or frame-ancestors, and Referrer-Policy. It also flags a Server or X-Powered-By header that leaks your software version.
• Cookie security. Whether your cookies set the Secure, HttpOnly and SameSite flags. A session cookie missing these is a common route to account hijacking.
• TLS / SSL configuration. An inspection of your HTTPS setup with testssl.sh: weak protocols, weak ciphers, and certificate problems, not just "is there a padlock".
• DNS and email security. SPF, DMARC and DNSSEC (and related records such as DKIM, MTA-STS and CAA). Gaps here are what let scammers send email pretending to be your domain.
• Open ports. A scan of the common ports to spot anything exposed to the internet beyond the web ports (80 and 443) that should probably be firewalled off.
• Known vulnerabilities. Thousands of community templates for known CVEs, misconfigurations, exposed files (like a stray .git or .env), and default logins, matched against the software your site actually runs.
• Web-application testing. A crawler that maps your pages and checks them for common web flaws. The full tier also actively probes them for flaws such as cross-site scripting and injection.
• WordPress. If the scan detects WordPress, it runs WordPress-specific checks on top.

From raw findings to a report you can use

Each thing the scanner spots becomes a finding, tagged with a severity of critical, high, medium, low or info. On its own a raw finding is often cryptic (a CVE number, a header name, a testssl label). So once the scan finishes, TLDTrack sends the findings to an AI reviewer that:

• Writes a short executive summary in plain English, opening with your overall grade.
• Names the single biggest business risk the site faces right now.
• Produces a prioritised list of top actions, each with why it matters and concrete how-to steps tailored to your stack (wp-cli commands for WordPress, nginx directives for nginx, the exact DNS record to add).
• Groups related findings into themes with copy-pasteable fixes.

The AI is told never to invent a vulnerability that the scanner did not actually find. The full breakdown of what the grade and severities mean is in Reading your security grade.

How to run a scan, step by step

1. 1
   Open the website you want to scan from your Domains list and go to its Security Scans tab.
2. 2
   Click Run scan. TLDTrack first spends a few seconds on a pre-flight: it checks the site is reachable, tests each category, and detects whether the site sits behind a WAF or CDN.
3. 3
   If the site is behind a WAF, you are shown a short choice: allowlist our scanner's IP so it can see everything, tell us your origin server IP so we can bypass the WAF, or skip and scan through the WAF, which can block checks or stop the scan.
4. 4
   Choose who should receive the finished report by email. You are always included; you can add teammates.
5. 5
   Pick the tier (baseline or full) and press Start scan. The scan is queued and you are taken to its live status page.
6. 6
   Watch it run. The page updates itself as findings come in, then shows the grade, the AI summary and the full findings table when it completes.

Scanning a domain you do not monitor

You can also scan a domain that is not in your portfolio, for example a prospect's site or one you are about to take on. Enter the domain, confirm you have permission to test it, and it runs the same way and uses credits in the same way. To keep costs and abuse in check, external scans are limited to five in any 24 hours per organisation.

What a scan costs you

A baseline scan costs 2 credits and a full scan costs 8. Credits come from your plan's monthly allowance first (250 on Starter, 1,250 on Pro and 5,000 on Agency), then from any top-up pack you have bought. If a scan fails or you cancel it, credits it took from a top-up pack are handed back; credits taken from the monthly allowance are not. The credit pool is shared with SEO, accessibility, compliance and journey checks, which is explained in Scan credits explained.

Good to know

• Only one scan runs on a given site at a time. If a scan is already in progress, start the next one when it finishes.
• Every completed scan can be exported as a PDF report, and you can filter that export by severity or by category before you download it.
• Past scans are kept, so you can watch a site's grade improve as you work through the fixes.
• A scan is a point-in-time snapshot. Re-run it after you make changes, or after any major update to the site, to confirm the issues are gone.

Where to run a scan