WordPress Scanner

Polite TCP-connect port scan of a single public host (max 128 ports) with optional banner grab.

Scan a web server for known-bad paths, vulnerable software fingerprints, and common misconfigurations.

Probe a website for exposed config files, backup dumps, admin panels, and missing security headers — the same ~120 checks attackers run.

Verify a site publishes security.txt, robots.txt, sitemap.xml, app-linking files, and other well-known disclosure standards.

Fetch a URL and grade its HTTP security headers — CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, and more.

Verify whether a domain qualifies for and is listed on the HSTS preload list.

Parse and grade a Content-Security-Policy header, flagging unsafe directives and common bypass vectors.

Query the OCSP responder for a certificate and verify it has not been revoked.

Look up a domain's CAA DNS records to verify which Certificate Authorities are authorised to issue certificates for it.

Detect installed Drupal core and contributed-module versions and check them against our own vulnerability database.

Run a large, actively maintained detection-signature library against a target to find CVEs, exposed panels, misconfigurations, and default credentials.

Exhaustive TLS audit — protocol support, cipher suites, certificate chain, and 20+ known vulnerability checks (Heartbleed, ROBOT, POODLE, BEAST, and more).

Compute a genuine JA3S fingerprint from a server's real ServerHello and test whether it enforces its own cipher order.