MSRXHow the scanner works
When you scan a URL, our server makes a small number of ordinary requests: it loads the page once (following up to five redirects), asks the plain-HTTP address whether it redirects, fetches /.well-known/security.txt, and reads public DNS records. That is roughly what a browser and a mail server do every day. It never sends attack payloads, submits forms, logs in, guesses paths or crawls the site.
The score out of 10
Every check is worth points according to how much it protects real visitors. A check earns all, part or none of its points. The score is points earned divided by points available, times ten, to one decimal place. Two caps keep it honest:
- Any open critical finding (no HTTPS, an untrusted or expired certificate, a password form over HTTP) caps the score at 4.0.
- Two or more open high findings cap it at 6.0.
| Score | Grade | Meaning |
|---|---|---|
| 9.0–10 | A+ | Excellent: modern hardening throughout |
| 8.0–8.9 | A | Strong: a few refinements left |
| 7.0–7.9 | B | Good: solid basics, notable gaps |
| 5.5–6.9 | C | Fair: several protections missing |
| 4.0–5.4 | D | Weak: easy wins are being missed |
| below 4 | F | At risk: fix the critical items now |
Recent CVEs
The scanner recognises more than 30 products from signals the page already gives away: Server and X-Powered-By headers, generator tags, cookie names, asset paths and login-page titles. Where the site publishes an exact version (PHP, WordPress, Apache httpd, nginx), it is matched against vulnerabilities from the last 12 months copied from each vendor's advisory, including php2shell (CVE-2026-109618 and CVE-2026-109619) and the 2026 WordPress core RCEs. A match on an actively exploited CVE is a critical finding. Server banners can lag Linux distributions' backported fixes, so those matches are marked “likely”.
Where a product is recognised but its version is hidden, such as Next.js apps that may be exposed to React2Shell (CVE-2025-55182), Drupal, Magento, SharePoint, Citrix NetScaler or Fortinet, the report lists every vulnerability in CISA's Known Exploited Vulnerabilities catalog for that product from the last 365 days for you to check by hand. Those lists do not change the score: the scanner never sends exploit payloads to find out.
How findings become a SWOT
- Strengths: every check that passed.
- Weaknesses: gaps in your own configuration that make other attacks easier (missing headers, weak CSP, cookie flags, version banners).
- Opportunities: extra hardening beyond the baseline that would lift your score (HSTS preload, COOP, Permissions-Policy, SRI, CAA, security.txt, TLS 1.3).
- Threats: exposures an outsider can act on directly (no HTTPS, bad certificate, mixed content, vulnerable libraries, loose CORS, spoofable email).
“Fix these first” ranks open findings by points lost multiplied by severity, so the top of the list is where an hour of work moves the score most.
Every check and its weight
| Check | Area | Points | If not passed |
|---|---|---|---|
| Served over HTTPS | Transport | 6 | Threat |
| HTTP redirects to HTTPS | Transport | 3 | Threat |
| HSTS | Transport | 3 | Weakness |
| HSTS preload readiness | Transport | 1 | Opportunity |
| Certificate trust | TLS | 5 | Threat |
| Certificate expiry | TLS | 2 | Threat |
| TLS protocol version | TLS | 2 | Threat / Opportunity |
| Content Security Policy | Headers | 4 | Weakness |
| Clickjacking protection | Headers | 2 | Weakness |
| MIME sniffing protection | Headers | 2 | Weakness |
| Referrer-Policy | Headers | 1 | Weakness |
| Permissions-Policy | Headers | 1 | Opportunity |
| Cross-Origin-Opener-Policy | Headers | 1 | Opportunity |
| CORS | Headers | 3 | Threat |
| Version disclosure | Disclosure | 2 | Weakness |
| Cookie flags | Cookies | 3 | Weakness |
| Mixed content | Content | 3 | Threat |
| Forms over HTTP | Content | 2 | Threat |
| Known CVEs in detected software | Software | 4 | Threat |
| Known-vulnerable JS libraries | Content | 3 | Threat |
| Subresource Integrity | Content | 1 | Opportunity |
| security.txt | Disclosure | 1 | Opportunity |
| CAA | DNS | 1 | Opportunity |
| SPF | DNS & email | 2 | Threat |
| DMARC | DNS & email | 2 | Threat |
What an outside scan cannot see
The scanner reads one public page from the outside. It cannot find SQL injection, broken access control, insecure APIs, business-logic flaws, weak passwords, unpatched server software that hides its version, or vulnerable libraries bundled into your JavaScript. A high score means your public surface is well configured; it does not mean the application is free of vulnerabilities. For that you need code review, dependency auditing and a professional penetration test.
Safety and fair use
- Scan only sites you own or have permission to test.
- Private, local and reserved addresses (127.0.0.1, 10.x, 192.168.x, cloud metadata and so on) are refused, including when a domain name resolves to one.
- Each visitor can run 8 scans per 10 minutes, and repeat scans of the same URL within 5 minutes are served from a short-lived memory cache instead of contacting the site again.
- Requests identify themselves with the user agent
MSRX-SecurityScanner/1.0 (+https://security.msrx.co.in/about), so site owners can recognise them.