Website security checks.
Choose the right scope.
Compare the checks available in the protected CyberScan workspace. Live assessments require existing authorised access; the guides, review and sample report here are public.
Which route fits your question?
Choose what you want to understand. We’ll show the requirements and a useful next step.
This chooser does not start a scan or connect an account.
Start with a public security check
Review public DNS, email authentication records, HTTPS connectivity and website headers. Findings include evidence, uncertainty and next steps.
Compare the checks.
| Your decision | Public security check | HostedScan | Pentest-Tools.com |
|---|---|---|---|
| Best starting question | Which public web and email settings need attention? | What does the provider’s TLS assessment report? | What does the provider’s passive website assessment report? |
| What starts in the protected workspace | 13 baseline check entries, including an optional DKIM selector lookup. | An SSLYZE scan against an existing HostedScan target. | Website Scanner tool 170 in light mode, against an existing public URL target. |
| Before you start | Sign in, confirm permission and verify domain control using a DNS TXT record or HTTPS file. | Connect your HostedScan API key, select an existing target and confirm permission. | Connect your Pentest-Tools.com API key, select an existing target and confirm permission. |
| Target scope | The supplied public hostname and ordinary homepage responses. Different hostnames need their own assessment. | The selected target and SSLYZE coverage available in your provider account. | HTTP or HTTPS URL on port 80 or 443. Same-host redirects, no VPN and a 15-minute provider limit. |
| What you receive | Dated observations, evidence, coverage, suggested owners and next actions. | Provider status and a bounded import of normalised findings. Detailed evidence stays in HostedScan. | Provider status and a bounded import of normalised findings. Detailed evidence stays in Pentest-Tools.com. |
| API key | No scanner API key or scanner subscription required. | Your own key, used for the current connection session. Provider API access and plan limits apply. | Your own key, used for the current connection session. Provider API access and plan limits apply. |
| When it runs | On demand after current domain verification. Start a fresh check when you need to retest. | On demand. Refresh the saved report to retrieve the provider’s current result. | On demand. Refresh the saved report to retrieve the provider’s current result. |
| What it does not establish | No exploit, port, malware or authenticated application assessment. No complete TLS or email-delivery validation. | No whole-application assurance. An API connection does not mean the target was tested after login. | No full active website scan from this launch mode. An API connection does not mean the target was tested after login. |
What the 13 public check entries cover
- Domain and DNS: public A/AAAA resolution and CAA record observations.
- Web settings: HTTPS connectivity, the initial HTTP-to-HTTPS redirect, HSTS, Content Security Policy, content-type protection, framing protection and Referrer-Policy.
- Email settings: MX, SPF and DMARC observations, plus DKIM key presence when you provide the correct selector.
The report always shows the DKIM entry; without a selector it is marked not tested. Header checks need a suitable successful response. A blocked request, unsupported redirect or resolver failure leaves the relevant checks unknown.
These are configuration observations. The baseline does not verify every policy rule, actual message alignment, certificate expiry, supported ciphers, plugins, malware, account security or internal systems. A pass applies only to the stated observation.
Existing scans keep their own scope
You can also import recent scans already in your provider account. An imported scan may use a different tool or mode from the two launch options above. Its configured target, completed tests and provider report define the coverage.
The connection lists up to 100 existing targets and 25 recent scans. Finding imports are limited to 30 HostedScan findings or 100 Pentest-Tools.com findings. Incomplete imports, failed jobs and unknown provider states remain visible; missing results are never counted as passes.
Choose a useful next step
For public settings, begin with a verified-domain check. For a provider’s TLS or website assessment, use the corresponding connected route. If the question concerns access controls, business logic or data behind a login, arrange an appropriately scoped assessment with your provider.
Checks in the protected workspace run on demand. No continuous monitoring, scheduled scans or incident-response service is enabled.
Provider documentation
For the next step, use the website security overview, the email authentication workflow or the vulnerability management and evidence guide.