# Passive website security scan - agentmarkup

> Passive security scan for public websites: HTTPS and HSTS, Content-Security-Policy, clickjacking and sniffing protections, cookie flags, mixed content, and security.txt.

Source: https://agentmarkup.dev/security-scan/

Free security check

# Passive security scan for public websites

Check the public safety signals a website shares with every visitor. You get clear findings and next steps, never an invented score.

This scan and the [website checker](/checker/) share the same per-IP limit of 10 requests per 10 minutes. One complete scan counts as one request against that shared budget, not one request per internal fetch. Need a general introduction first? Read the [plain-language website guide](/blog/website-checker/).

 What this scan checks and authorized-use details

An overview of the areas the scan looks at. All of it is read from public responses and public DNS records.

- **Transport security:** whether the site is reachable over HTTPS, whether plain HTTP redirects to HTTPS, and HSTS.
- **Response headers:** Content-Security-Policy, clickjacking protection, MIME-sniffing protection, Referrer-Policy, Permissions-Policy, and cross-origin isolation.
- **Content and cookies:** cookie security flags, exposed server or framework version headers, mixed content, and Subresource Integrity on cross-origin scripts.
- **Discovery and email:** a security.txt contact file, and SPF, DMARC, and DNSSEC read from public DNS.

## Passive and authorized use only

This is a passive read of publicly served responses, not a penetration test or vulnerability scan. Only scan sites you own or are authorized to assess. Findings describe missing defense-in-depth headers, not proof of exploitability.

The scan sends ordinary GET requests to conventional public URLs and a few read-only DNS lookups. It does not enumerate paths, scan ports, send payloads, fuzz inputs, probe TLS, authenticate, or run a headless browser.

Requests use the fixed identifying user agent `agentmarkup-checker/... (+https://agentmarkup.dev)`. Nothing is hidden or spoofed; the traffic is browser-equivalent and identifies this service.

## Frequently asked questions

 What does the passive security scan check?

It checks public HTTPS and HSTS behavior, security response headers, cookie flags, mixed content, Subresource Integrity, security.txt, and public SPF, DMARC, and DNSSEC records.

 Is this a penetration test or vulnerability scan?

No. It uses ordinary read-only web and DNS requests. It does not scan ports, enumerate private paths, send attack payloads, authenticate, fuzz inputs, or certify that a website is secure or insecure.

 Can I scan any website?

Only scan a website you own or are authorized to assess. The authorization checkbox is required before the scan runs.

 How is this different from the website checker?

The security scan reviews public safety signals. The website checker reviews machine readability, structured information, discovery files, and AI crawler access. They answer different questions and do not share findings.