Skip to content
AEGIS

Features

A focused toolset — not a wall of vanity metrics.
scroll to explore ↓

Ownership verification

DNS TXT or /.well-known file. Scanning and subdomain discovery stay locked until it succeeds.

Live scan experience

Nine visible stages with real progress, elapsed time and issues found — never an endless spinner.

Evidence-backed findings

Observed value, expected condition, source, timestamp, confidence and limitations on every result.

Aegis Security Score

Deterministic, versioned, deduplicated and bounded 0–100, with full history.

Passive subdomain discovery

Hostnames from public Certificate Transparency logs, resolved once. No brute forcing.

Monitoring & alerts

Daily or weekly rescans; in-app alerts for high-severity findings, score drops, expiring certificates and outages.

Reports

Printable snapshots with score, findings, recommendations, methodology and limitations.

Teams & roles

Isolated workspaces with Owner, Admin and Member roles enforced in the database.

Audit trail

Logins, verifications, scans, finding changes and settings changes are recorded.

Try it · mini game

Patch the response.

This is the kind of HTTP response Aegis inspects. Click each red line to apply the fix Aegis would recommend — and watch the score and the 3D field react.

60/ 100 · 0/6 patched
HTTP/2 200 · shop.example.com● 6 issues

The 33 checks

This list is generated from the scanner's live check registry, so it always matches what actually runs.

DNS / Domain · 6

  • Domain resolvesdns.resolution

    No A or AAAA records were returned for the hostname.

  • SPF record publisheddns.spf

    The domain publishes no Sender Policy Framework (SPF) record declaring which servers may send its email.

  • SPF policy strictnessdns.spf_policy

    The SPF record ends with a permissive or neutral `all` mechanism, or none at all.

  • DMARC record publisheddns.dmarc

    No DMARC record was found at _dmarc of the domain.

  • DMARC enforcementdns.dmarc_policy

    The DMARC record uses `p=none`, which reports but does not stop spoofed mail.

  • CAA record restricts certificate issuancedns.caa

    The domain does not publish CAA records, so any public CA may issue certificates for it.

HTTPS / TLS · 8

  • HTTPS is availabletls.https_available

    The site did not respond to an HTTPS request on port 443.

  • HTTP redirects to HTTPStls.http_redirect

    A plain-HTTP request was answered without redirecting the visitor to the HTTPS version of the site.

  • Certificate chains to a trusted CAtls.cert_trusted

    The certificate presented by the server failed chain validation against the public trust store.

  • Certificate matches hostnametls.cert_hostname

    None of the names in the certificate's Subject Alternative Name list match the website hostname.

  • Certificate validity periodtls.cert_expiry

    The certificate's notAfter date has passed or is close.

  • Negotiated TLS protocol versiontls.protocol

    The server negotiated a TLS version older than 1.2 with a modern client.

  • Certificate chain observationtls.chain

    Issuer, subject and chain length of the presented certificate.

  • Mixed content on HTTPS pagetls.mixed_content

    The HTML of the HTTPS homepage loads scripts, styles, frames or media over plain HTTP.

Security headers · 10

  • Strict-Transport-Security presenthdr.hsts

    The HTTPS response does not include a Strict-Transport-Security header.

  • HSTS policy strengthhdr.hsts_strength

    The HSTS max-age is shorter than 180 days or the policy does not cover subdomains.

  • Content-Security-Policy presenthdr.csp

    No enforcing Content-Security-Policy header was returned.

  • CSP script restrictionshdr.csp_quality

    The CSP permits inline scripts, eval, or wildcard script origins, which undermines its protection against XSS.

  • X-Content-Type-Options: nosniffhdr.xcto

    The X-Content-Type-Options: nosniff header is absent.

  • Clickjacking protectionhdr.frame

    Neither X-Frame-Options nor a CSP frame-ancestors directive restricts who may embed this page.

  • Referrer-Policyhdr.referrer

    No Referrer-Policy header is set, or it allows full URLs to be sent to other origins.

  • Permissions-Policyhdr.permissions

    The site does not declare which powerful browser features (camera, microphone, geolocation…) it and embedded content may use.

  • Cross-Origin-Opener-Policyhdr.coop

    Without COOP, pages opened from or opening this site share a browsing context group with it.

  • CORS configuration on homepagehdr.cors

    The response allows any origin to read it, combined with credentials.

Cookies · 4

  • Cookies use the Secure flagcookie.secure

    One or more cookies are set on an HTTPS site without the Secure attribute, so browsers will also send them over plain HTTP.

  • Session-like cookies use HttpOnlycookie.httponly

    Cookies whose names suggest session or authentication use are set without HttpOnly.

  • Cookies declare SameSitecookie.samesite

    Cookies are set without SameSite, or with SameSite=None but without Secure.

  • Cookie domain scopecookie.domain_scope

    Cookies set a Domain attribute that makes them available to every subdomain of a parent domain.

Server / Exposure · 5

  • Server header version disclosureexp.server_version

    The Server response header reveals the web server product and version number.

  • Framework / technology headersexp.framework_headers

    Headers such as X-Powered-By or X-AspNet-Version reveal the application framework and possibly its version.

  • Generator meta tag versionexp.generator_meta

    A `<meta name="generator">` tag in the homepage HTML includes a version number.

  • security.txt publishedexp.security_txt

    The site does not publish /.well-known/security.txt telling researchers how to report vulnerabilities.

  • Exposed .git repositoryexp.git_exposed

    The /.git/HEAD file is served publicly, which usually means the whole .git directory — source code and history — can be downloaded.