What is Vulscore?
Vulscore checks website security, TLS, performance, DNS and network configuration, with clear evidence and practical next steps.
Scan your website
Find common security misconfigurations in your website. Enter a URL to get started.
Just looking? Try the sample report — no website is contacted.
SAMPLE REPORT · ILLUSTRATIVE DATA
Scan results
https://demo.example/
This is a demonstration using fabricated responses. No request was sent to this domain.
2Findings
3To review
6Checks passed
3Inconclusive / not run
VULSCORE · CONFIGURATION RISK
Vulnerability score
31 / 100
Low observed risk
Provisional- 0–33
- 34–66
- 67–100
Higher means more observed configuration risk.
78% weighted coverage. Unknown and unrun checks are not passes.
Current score: 31. It could reach 53 if all unresolved checks fail. Complete or manually review those checks before comparing results.
Vulscore’s own heuristic, not CVSS, an exploitability rating, or a count of confirmed vulnerabilities. A zero score does not mean the website is secure.
How the score is calculated
Fixed weights total 100. Fail adds the full weight; warning adds half; pass adds zero. Unknown checks remain unresolved. The total is rounded up. Coverage is the sum of resolved weights. Website availability is a prerequisite, not a scored security check.
| Check | Weight | Outcome | Risk points |
|---|---|---|---|
| HTTPS connection | 20 | Pass | 0 |
| Strict transport security | 10 | Warning | 5 |
| Content Security Policy | 15 | Fail | 15 |
| Clickjacking protection | 5 | Pass | 0 |
| Content-type sniffing | 5 | Pass | 0 |
| Referrer privacy | 3 | Pass | 0 |
| Browser permissions | 2 | Warning | 1 |
| Technology disclosure | 3 | Warning | 1.5 |
| Cookie attributes | 10 | Unknown | Unresolved |
| HTTP to HTTPS redirect | 7 | Pass | 0 |
| Error detail exposure | 8 | Fail | 8 |
| ASP.NET tracing | 6 | Unknown | Unresolved |
| ELMAH error logs | 6 | Unknown | Unresolved |
A point-in-time configuration check, not a penetration test or guarantee of security. “Passed” means this specific check found no issue in the sampled response.
Content Security Policy:Fail
What we observed
No enforced Content-Security-Policy header was returned.
How to fix it
Use a restrictive enforced CSP with explicit script sources, object-src 'none', and base-uri 'none' or 'self'. This heuristic does not fully validate CSP or multiple policies.
Error detail exposure:Fail
What we observed
Sample finding: an error response exposed diagnostic details.
How to fix it
Use generic production error pages and disable developer exception output.
Strict transport security:Warning
What we observed
No Strict-Transport-Security header was returned.
How to fix it
Send Strict-Transport-Security: max-age=31536000 over HTTPS. Review every subdomain before adding includeSubDomains or preload.
Browser permissions:Warning
What we observed
No explicit Permissions-Policy was returned.
How to fix it
Review which features your application needs. Restrict unused camera, microphone, geolocation, and other features. Presence alone does not prove a safe policy.
Technology disclosure:Warning
What we observed
Server: ExampleServer/1.0
How to fix it
Remove unnecessary server/framework version headers in the application and reverse proxy. This is hardening, not evidence of a vulnerability.
Cookie attributes:Inconclusive
What we observed
This response set no cookies; authenticated/session cookies were not tested.
How to fix it
Use Secure and HttpOnly for session cookies, and SameSite=Lax/Strict where appropriate. Cookies needed by JavaScript or cross-site flows require context-specific review.
ASP.NET tracing:Inconclusive
What we observed
Sample finding: diagnostic check not run.
How to fix it
Enable optional diagnostics to inspect trace.axd.
ELMAH error logs:Inconclusive
What we observed
Sample finding: diagnostic check not run.
How to fix it
Enable optional diagnostics to inspect elmah.axd.
Website response:Pass
What we observed
Final response: HTTP 200. The requested page was available.
How to fix it
If a firewall blocked this scan, allow the scanner deliberately and rerun. Error-page headers may differ from your application.
HTTPS connection:Pass
What we observed
The final page used HTTPS with normal certificate validation.
How to fix it
Serve the site with a trusted TLS certificate and redirect HTTP to HTTPS. This is not a full TLS protocol or cipher audit.
Clickjacking protection:Pass
What we observed
X-Frame-Options: DENY
How to fix it
Use CSP frame-ancestors 'none' (or an explicit trusted allowlist) and X-Frame-Options: DENY for legacy clients. Custom allowlists need manual review.
Content-type sniffing:Pass
What we observed
Observed: nosniff
How to fix it
Set X-Content-Type-Options: nosniff and serve each resource with its correct Content-Type.
Referrer privacy:Pass
What we observed
Observed: strict-origin-when-cross-origin
How to fix it
Set Referrer-Policy: strict-origin-when-cross-origin or a stricter policy to limit URL disclosure.
HTTP to HTTPS redirect:Pass
What we observed
Sample finding: HTTP redirects directly to HTTPS.
How to fix it
Keep the redirect enabled at the edge.
Reports are not saved by Vulscore. Use your browser’s Print / Save as PDF to keep this result.
What does it check?
HTTPS, security headers, cookie settings, and technology disclosure, with optional checks for ASP.NET error pages, tracing, and ELMAH.
What happens to my data?
Reports are generated on demand and aren’t saved by the application. Cookie values and diagnostic response bodies stay out of the report.