What does an automated website security scan actually check?
A scan is a checklist, not magic
An automated security scan is not an attacker hacking your site. It is a structured inspection: a crawler that loads what is publicly reachable, and a set of rules that each look for one known mistake. That is good news — it means the coverage is concrete, and you can understand exactly what is being checked. Here are the eight things that matter.
1. Exposed secrets
The scan reads your pages and JavaScript for things that should never be public: API keys, access tokens, database connection strings, private keys. These leak because a key meant for the server ends up in code the browser downloads.
2. TLS and certificates
Is your HTTPS actually strong? This checks the protocol versions you accept, the cipher suites you offer, and the health of your certificate — expiry, hostname match, a complete chain. Weak or outdated crypto here undermines everything else.
3. Security headers
A handful of HTTP response headers tell the browser how to protect your users — Content-Security-Policy against script injection, HSTS to force HTTPS, X-Frame-Options against clickjacking, and a few modern ones. The scan checks which are present and whether they are configured safely.
4. Cookie flags
Session cookies carry the keys to a logged-in account. The scan checks for the three flags that protect them: HttpOnly (hidden from scripts), Secure (HTTPS only), and SameSite (resistant to cross-site request forgery).
5. Leaked files
Some of the worst exposures are a single misplaced file: a public .env, an exposed .git folder, a source map, a database dump, a config backup. The scan requests the paths attackers try first and reports anything that answers.
6. CORS rules
Cross-Origin Resource Sharing decides who may call your API from another site. A rule that reflects any origin while allowing credentials quietly hands your authenticated API to any website. The scan probes how your server responds to foreign origins.
7. Dependencies
Your site ships code you did not write. The scan fingerprints front-end libraries for end-of-life versions and flags known-compromised packages from real supply-chain incidents.
8. Frontend leaks
Finally, the small stuff that escapes the build: internal URLs, localhost or private-IP references, source-map comments, secrets tucked in HTML comments. Individually minor, together a map of your internals.
What a scan does not do
An automated scan will not understand your business logic, guess a weak password, or replace a manual penetration test. What it does — consistently, repeatably, and in minutes — is catch the exposure and configuration mistakes that make up the overwhelming majority of real-world incidents. Run one and see which of the eight your site clears today.