Security scanningAll features.
Everything a Security scan does today: each check by name, how the grade is worked out, and what is in the report.
30 features in 7 groups, checked against the product on 14 November 2026.
What it checks
30 checks on every scan, and up to three more when they apply.
HTTPS
That the site answers over HTTPS, and that plain HTTP redirects to it.
Security headers (8)
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or a frame-ancestors rule), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy: whether each one is sent.
A weak Content-Security-Policy
When the policy allows unsafe-inline or unsafe-eval, that is reported as a check of its own.
What the server gives away (2)
A Server header that states a version number, and an X-Powered-By header. When a page names the software that made it, that is noted too.
Cookies
Whether the cookies the home page sets carry Secure, HttpOnly and SameSite.
Exposed files (10 paths)
Git metadata (two paths), an environment file, Subversion metadata, a backup of a WordPress configuration, a PHP information page, a Spring Boot actuator, a .DS_Store file, a server status page and an API description. An open directory listing under /uploads/ is reported when one is found.
security.txt
Whether the site publishes one.
Email and DNS (6)
SPF, DMARC, DKIM (six common selectors), CAA, MX and DNSSEC.
What a scan requests
The home page over HTTPS and over HTTP, twelve fixed paths, and up to eleven DNS lookups. Nothing else is requested.
The grade
A score out of 100
It starts at 100. Each check that fails or warns takes off 15 points when its severity is high, 8 when medium and 4 when low. The rules are fixed; AI does not decide the score.
A letter from A+ to F
A+ from 95, A from 90, B from 80, C from 70, D from 60, and F below 60.
Four severities
High, medium, low and informational. An informational check, such as DKIM, CAA, MX, DNSSEC or security.txt, never changes the score.
What to change
The text of a failing check says what to change.
The AI summary
Three parts
A summary, the top three priorities in order of risk, and why they matter, in under 220 words.
Written from the findings
The AI is given the grade, the score and the checks that failed or warned, and is told to add no issue of its own and to say that this is not a penetration test.
If the AI is not available
The report has no summary. The checks and the grade are not affected.
The report
In the dashboard
The grade, the score, the number of checks that failed, warned and passed, the AI summary, and every check grouped by category.
As a PDF
Titled Automated Security Assessment: the site, the time of the scan, the grade, the score, the three counts, the AI summary and every check by category, with page numbers and the time the report was made.
Combined report
On the Reports page up to 50 reports, from this product and the others, can be merged into one PDF with a cover and a contents page.
History
The page shows your 10 most recent scans.
Running it
Choose a site and run
There are no other settings.
Starts within about a minute
Queued scans start once a minute, one at a time, so it can take longer when the queue is busy.
One scan at a time
A second scan cannot be queued while one of yours is queued or running.
A recognisable user agent
Requests are sent as BCDRPulse-Scanner/1.0.
Ownership and safety
Verified sites only
A run is accepted only for a site of yours whose DNS record has been confirmed, and the site is checked again when the run starts.
Public addresses only
A host that does not resolve to a public address is refused when you ask for the run and again before it starts.
Plans and limits
Pro
100 scans a month.
Business
500 scans a month.
Resets on the 1st
Allowances count over the calendar month, in UTC, and reset on the 1st.
A scan that never started is not counted
For example one refused because the host was not a public address.
What it does not do.
- It does not exploit anything, send attack payloads, sign in, or read pages beyond the home page and its fixed list of paths.
- It does not match software versions against lists of known vulnerabilities.
- It does not inspect the certificate, the protocol versions or the ciphers. Deep TLS analysis does.
- It judges an exposed path by the HTTP status alone, so a site that answers 200 for every address can be marked down for files it does not have.
- It has no schedule, and it does not compare one scan with another.
- It is not a penetration test: nothing is exploited and your application's logic is not tested. We do not offer one.