01
Add website
Enter a domain. Aegis validates it server-side and refuses localhost, private networks and cloud-metadata addresses.
Preview · DEMO
shop.example.com
BLOCKED_TARGET 169.254.169.254
Domain resolvesSPF record publishedSPF policy strictnessDMARC record publishedDMARC enforcementCAA record restricts certificate issuanceHTTPS is availableHTTP redirects to HTTPSCertificate chains to a trusted CACertificate matches hostnameCertificate validity periodNegotiated TLS protocol versionCertificate chain observationMixed content on HTTPS pageStrict-Transport-Security presentHSTS policy strengthContent-Security-Policy present
CSP script restrictionsX-Content-Type-Options: nosniffClickjacking protectionReferrer-PolicyPermissions-PolicyCross-Origin-Opener-PolicyCORS configuration on homepageCookies use the Secure flagSession-like cookies use HttpOnlyCookies declare SameSiteCookie domain scopeServer header version disclosureFramework / technology headersGenerator meta tag versionsecurity.txt publishedExposed .git repository
Your pathChoose a pill to personalise the order of this page.
Product tour
From a domain name to a monitored, improving posture.
02
Verify
Prove ownership with a DNS TXT record or a file under /.well-known/. Nothing is scanned until this succeeds.
Preview · DEMO
_aegis-verification.shop…
aegis-verification=8f3c…
✓ Verified03
Scan
33 read-only checks run through nine live stages. No brute force, no exploits, no payloads.
Preview · DEMO
Target
Domain
TLS
Headers
Cookies
DNS
Exposure
Risk
Score
04
Understand
Every finding shows what was observed, what was expected, the source and its confidence.
Preview · DEMO
HSTS header missingMedium
observed: null expected: header present confidence: high
05
Improve
Plain-language impact and a concrete fix. Rescan to confirm — resolved findings close automatically.
Preview · DEMO
Add
Strict-Transport-Security: max-age=3153600006
Monitor
Daily or weekly rescans track score history and alert you to new high-severity issues.
Preview · DEMO
Why Aegis
Evidence first. Always.
No finding exists without an observation. Each result records what was seen, what was expected, where it came from and how confident we are.
{ check: "hdr.csp", observed: null,
expected: "Enforcing Content-Security-Policy",
source: "GET https://shop.example.com/", confidence: "high" }A score you can audit
v1.0: start at 100, −25/15/7/2 per open critical/high/medium/low finding. Bounded 0–100.
Safe by design
Verified owners only. Every request SSRF-guarded, rate-limited and read-only.
33 meaningful checks. No padding.
6
DNS / Domain
8
HTTPS / TLS
10
Security headers
4
Cookies
5
Server / Exposure
Try it · mini game
Patch the response.
This is the kind of HTTP response Aegis inspects. Click each red line to apply the fix Aegis would recommend — and watch the score and the 3D field react.
60/ 100 · 0/6 patched
HTTP/2 200 · shop.example.com● 6 issues
Arcade · 30 seconds
Packet defense.
Click malicious packets before they reach your server. Let normal traffic through. (Just a game — Aegis itself never attacks anything.)
score 0shield ▮▮▮▮▮time 30sbest 0
red = malicious · green = normal traffic
What Aegis is
- ✓Website security posture intelligence
- ✓Observable checks of TLS, headers, cookies, DNS & exposure
- ✓Scheduled monitoring with score history and alerts
- ✓Shareable reports with methodology and limitations
What Aegis is not
- ✕A penetration test or full security audit
- ✕A certification or guarantee of security
- ✕Real-time protection or a firewall
- ✕A tool for scanning sites you don't control