Guides
Plain-language explanations of what your website shows to every visitor, and what to ask your developer or host to change.
Security headers explained for website owners
The short instructions your site sends to every browser, what each one protects against, and the values to ask your developer for.
SPF and DMARC for small sites
Three DNS records that stop strangers sending email that looks like it comes from you, and the order to set them up in.
What an external website scan can and cannot see
What any outside-in check, ours included, can learn about your site, where it goes blind, and what a clean report does and does not prove.
How each check works
One page per check in a Scanylo report: what it reads, what it reports and what it cannot see.
- How the security headers check worksThe instructions your server sends to browsers with every page.
- How the cookies check worksWhether the cookies your site sets are protected on the way and in the browser.
- How the secure connection check worksYour certificate, the encryption your server accepts, and whether visitors are moved to https.
- How the email and DNS check worksThe public DNS records that stop fake email in your name, and addresses pointing to services you no longer use.
- How the technology check worksWhat your site is built with, worked out from what it shows publicly.
- How the vulnerability wave check worksWhether what we can see matches a major vulnerability in the news.
- How the known flaws in components check worksWhether a library or framework version your site shows has a published security advisory.
- How the exposed files check worksA short, fixed list of files that should never be public, such as settings and backups.
- How the error pages check worksWhat your site reveals when something goes wrong.
- How the keys in public scripts check worksPasswords, API keys and private keys left in your pages, scripts and source maps.
- How the cross-site access check worksWhether your site lets any other website read its pages through a visitor's browser.
- How the file storage check worksWhether anyone can list every file in the cloud storage your site uses.
- How the outside services check worksThe scripts and frames your pages load from other companies, and any from a compromised CDN.