Site protection scan: Is anything standing between your site and attackers?
Enter a domain. We look for a web application firewall or CDN in front of it (DNS, headers, cookies, block pages), send one harmless attack-looking request to see if anything stops it, then check HTTPS, the certificate and the security headers. One grade, with the fix for each gap.
What it does
- WAF and CDN detection: Cloudflare, Akamai, Imperva, Sucuri, AWS, Fastly, Azure, F5, Wordfence, ModSecurity and more
- One probe request (an XSS and SQL injection look-alike) to see whether it is blocked or let through
- Evidence for each finding: CNAME, header, cookie name or block page
- Certificate, TLS versions, HTTPS redirect, HSTS, CSP and the other security headers
- Copy-paste nginx and Apache fixes
- Shareable result link
What goes in, what comes out
- What goes in
- A domain or hostname (example.com, www.example.com).
- What comes out
- The services seen in front of the site with the evidence, whether the probe was blocked (and the status code), whether visitors reach the origin directly, then the SSL & headers lines, all in one A+ to F grade.
- Example
- 25 October 2026: www.akamai.com shows Akamai (CNAME to edgekey.net) and answers the probe with 403; osec.one's own marketing site shows nothing in front and lets the probe through (B, 71), which is what osec Edge is for.
- Limits
- Only what DNS and a browser can see: a firewall that never shows itself and lets the probe through isn't found. One probe, not a penetration test. 20 checks a day per IP address without an account.