About Securelyn Scan
A free check of the public security setup of a domain. It takes about a minute and needs no signup. It is a free tool from Securelyn.
What we check
SPF, DMARC, DKIM (common selectors only), MX, and MTA-STS and TLS-RPT records.
DNS
CAA records and DNSSEC.
Website
Whether HTTP redirects to HTTPS, whether HTTPS and the certificate work, HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, clickjacking protection, cookie flags, headers that show version numbers, and a security.txt file.
Software
Versions we can see in public headers and page content, matched against public vulnerability lists (NVD, CISA KEV and EPSS).
Public databases
Certificate transparency logs, domain registration records, the browser HSTS preload list and a public database of open ports and services. We read what these already hold. We do not scan your servers ourselves.
To do this we make DNS lookups, look things up in those public databases and make one normal visit to your home page. We also make one request to http:// to test the redirect and one to /.well-known/security.txt. This is the same traffic a browser sends.
The optional deeper check
Off by default. It runs only if you tick the box to confirm you are authorised to scan the domain. It then adds:
- GET requests only, to a short fixed list of common sensitive file locations (for example configuration files, backups and source repository folders), and to up to five public pages linked from your home page.
- We respect robots.txt. We never log in, submit a form or try to break in.
- Outside services that look at your site the way any visitor would: an independent website security scan and an independent TLS assessment service. They contact your site themselves, and we receive their results.
What we do not do
- No port scanning by us, login attempts, form submissions or attack payloads. Without the deeper check, no crawling and no probing of file locations.
- No proof that a system is or is not vulnerable. A software match says a version may be affected. Vendors often fix problems without changing the version number, and headers can be edited.
- No claim of compliance with any standard. Where a finding is related to the Essential Eight or other guidance, we say "related to".
- A missing DKIM result is shown as "unknown". Selectors vary, so it does not prove DKIM is absent.
How the grade works
The score starts at 100. Then we subtract:
| Finding | Points removed |
|---|---|
| Failed check, high severity | 15 each |
| Failed check, medium severity | 8 each |
| Failed check, low severity | 3 each |
| Warning | 2 each |
| Software match on the CISA KEV list (actively exploited) | 10 each, up to 30 in total |
| Other software matches | 2 each, up to 10 in total |
The lowest score is 0. Grades: A is 90 or more, B is 75 or more, C is 60 or more, D is 40 or more, and F is below 40.
Opt out
If you own a domain and do not want it scanned, do either of these:
- Email contact@securelyn.in with the domain name.
- Add a DNS TXT record with the value
securelyn-scan=deny. We check for it in both the standard and the deeper check.
We will then refuse scans of that domain.
How we identify ourselves
Our scanner sends this User-Agent:
SecurelynScanner/1.0 (+https://scan.securelyn.in/about)
Want help fixing things?
Talk to a Securelyn expert about what the scan found.