# Passive website security scan - agentmarkup

> Passive security scan for public websites: HTTPS and HSTS, Content-Security-Policy, clickjacking and sniffing protections, cookie flags, mixed content, and security.txt.

Source: https://agentmarkup.dev/security-scan/

# Passive security scan for public websites

Inspect the public HTTPS response, defensive headers, cookies, embedded resources, security.txt, and basic email authentication. Findings are deterministic pass, warning, or error results with no score. Slow targets can produce partial results instead of blocking the whole report.

This scan and the [website checker](/checker/) share the same per-IP limit of 10 requests per 10 minutes. One complete scan counts as one request against that shared budget, not one request per internal fetch.

## What this scan checks

An overview of the areas the scan looks at. All of it is read from public responses and public DNS records.

- **Transport security:** whether the site is reachable over HTTPS, whether plain HTTP redirects to HTTPS, and HSTS.
- **Response headers:** Content-Security-Policy, clickjacking protection, MIME-sniffing protection, Referrer-Policy, Permissions-Policy, and cross-origin isolation.
- **Content and cookies:** cookie security flags, exposed server or framework version headers, mixed content, and Subresource Integrity on cross-origin scripts.
- **Discovery and email:** a security.txt contact file, and SPF, DMARC, and DNSSEC read from public DNS.

## Passive and authorized use only

This is a passive read of publicly served responses, not a penetration test or vulnerability scan. Only scan sites you own or are authorized to assess. Findings describe missing defense-in-depth headers, not proof of exploitability.

The scan sends ordinary GET requests to conventional public URLs and a few read-only DNS lookups. It does not enumerate paths, scan ports, send payloads, fuzz inputs, probe TLS, authenticate, or run a headless browser.

Requests use the fixed identifying user agent `agentmarkup-checker/... (+https://agentmarkup.dev)`. Nothing is hidden or spoofed; the traffic is browser-equivalent and identifies this service.