Guides · ← All guides
What Does a Website Security Scan Check?
Last updated: October 31, 2026 · Reviewed October 2026 · 8 min read
"Run a scan" sounds like one action. It is actually eight separate modules, each looking at a different layer of your site, each producing a different kind of finding. This page walks through all eight — the exact modules in BreachHunter's engine — so you know precisely what a scan does and does not look at before you run one.
What are the eight scan modules?
| Module | What it checks | What a finding looks like |
|---|---|---|
| Recon | DNS records, subdomains from certificate-transparency logs, technology fingerprinting, subdomain-takeover fingerprints, DNS zone-transfer (AXFR) attempts, email authentication (SPF/DMARC), end-of-life software in banners | "Subdomain takeover possible" · "Apache 2.2 is end-of-life" |
| Ports | 23 TCP ports with banner grabbing | "Redis is exposed — CRITICAL" · "MySQL is exposed — HIGH" |
| TLS | Certificate expiry, self-signed certificates, hostname mismatch, protocol versions, HSTS | "Certificate expires in 6 days" · "TLS 1.0 still enabled" |
| Web audit | 6 security headers, cookie flags, 33 sensitive-file paths, deleted files still served from the web archive, unprotected AI media endpoints | "Exposed .env file — CRITICAL" · "Missing Content-Security-Policy" |
| Directory discovery | A 53-name wordlist of common directories and panels | "Admin panel exposed" · "Staging directory reachable" |
| Edge | Login and known-vulnerability paths for Ivanti, NetScaler, BeyondTrust and Fortinet appliances, plus Atlassian products | "Fortinet login reachable on an unpatched path" |
| Nextcloud | Checks specific to self-hosted Nextcloud instances | Instance misconfiguration findings |
| Secrets | Leaked-secret patterns in reachable content | "Possible API key in public file" |
Source: the BreachHunter scan engine (SCAN_TYPES and module code, app/pentest.py, version 1.6.0, read October 31, 2026). Every number on this page comes from that source — not from a brochure.
What does the recon module look at?
Recon builds the map an attacker would build: your DNS records, every subdomain ever issued a certificate (certificate-transparency logs are public and permanent), and the software versions your server announces in its banners. On top of the map it runs three tests owners rarely think of. It checks whether a forgotten subdomain points at a service you no longer control — a subdomain takeover waiting to happen. It attempts a DNS zone transfer, which some misconfigured servers still answer with their entire record list. And it grades your email authentication, because a domain without enforced DMARC is a domain anyone can spoof. Version banners get one more treatment: if the banner names software that is end-of-life — an old Apache, an unsupported PHP — that is a finding on its own, because it tells attackers exactly which known vulnerabilities to try.
Why do open ports matter?
Your web server needs ports 80 and 443. The ports module probes 23 in total, because the other 21 are where incidents start. Seven of them produce named, severity-rated findings when they answer the public internet:
| Port | Service | Severity if exposed |
|---|---|---|
| 23 | Telnet | CRITICAL — credentials travel in clear text |
| 3389 | RDP | CRITICAL — a top ransomware entry point |
| 6379 | Redis | CRITICAL — unauthenticated instances allow data theft and code execution |
| 27017 | MongoDB | CRITICAL — the classic copied-and-ransomed database |
| 3306 | MySQL | HIGH — brute-force and SQL-level attacks |
| 1433 | MSSQL | HIGH — frequent brute-force target |
| 21 | FTP | HIGH — usernames, passwords and files in clear text |
Source: RISKY_PORTS table, BreachHunter engine, read October 31, 2026. An open port is not proof of compromise — it is a door an attacker can knock on directly, skipping your web application entirely.
What does the TLS check catch?
Four failures, all common: an expired certificate (renewal automation breaks silently more often than owners expect), a self-signed certificate on a public site, a certificate whose hostname does not match the domain, and obsolete protocol versions still negotiated. It also notes whether HSTS is sent — the header that stops browsers from ever falling back to plain HTTP for your site. Each is cheap to fix and embarrassing to learn about from a customer.
Which files and headers does the web audit probe?
The web audit reads your responses the way a browser does. It checks for six security headers — Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy; our guide to what each missing header stops maps every one to the attack it prevents. It verifies the HttpOnly, Secure and SameSite flags on your cookies. And it requests 33 sensitive paths directly: /.env, /.git/HEAD, /.aws/credentials, /backup.zip, database dumps, SSH keys, and their backups and variants. The first 18 checks run in the free tier; the full set is a Pro module. If your .git directory answers, that is the single most urgent finding a scan can return — here is what it leaks and how to check it yourself.
What about edge devices and specific apps?
Three modules go narrower. The edge module checks whether the login and known-vulnerable paths of common VPN and access appliances — Ivanti, NetScaler, BeyondTrust, Fortinet — and Atlassian products are reachable and exposed. The Nextcloud module runs the checks specific to that platform (we also publish a dedicated Nextcloud check). The secrets module looks for leaked-secret patterns in what your server will hand to a stranger. These are the modules that turn a generic scan into one that knows what your stack actually runs.
Is a scan the same as a penetration test?
No — and the difference decides what you should buy first. A scan is the systematic, automated first hour of every attack: repeatable, read-only, complete in about a minute. A penetration test adds human testers who chain findings and probe business logic. Our companion guide explains what a full assessment tests, phase by phase, and how to read scan results and decide which findings to fix first. If you are deciding on budget, what a penetration test actually costs in 2026 lays out the three price shapes honestly. And if you would rather check the fundamentals by hand first, the 60-second small-team checklist is the scan's checks rewritten as a manual self-test.
Run the free BreachHunter scan on your site → — no credit card; the mini-scan runs signed-out, and the full eight modules unlock with a free account and Pro.
Frequently asked questions
Is a website security scan safe to run on my own site?
Yes. BreachHunter's scan is read-only: it requests pages and ports the way any visitor's browser or a search engine would, and reports what it finds. It does not exploit vulnerabilities, guess passwords, or modify anything on your server.
How long does a full scan take?
About a minute. The full scan runs under a 110-second wall-clock budget, and most sites complete well inside it.
What is the difference between the free scan and Pro?
The free scan covers the fundamentals — recon, the web audit with the first 18 sensitive-file checks, and the basic modules. Pro ($49 one-time) unlocks all eight modules, the full 33-file check set, evidence excerpts for each finding, and drift tracking that re-scans and flags what changed.
How often should I run a security scan?
After every major deployment, plus on a quarterly rhythm. If you process card payments, PCI DSS v4.0 (Requirement 11.3.2) requires external vulnerability scans at least quarterly. Continuous drift tracking covers the changes that happen between scheduled runs.