Version 1.3

What it is and what it isn't

The Website Security Scanner is a tool you can use to test and rate your website security. It is not a hacking tool: it won't hack your site and you can't use it to hack someone else's website either.
Whether you use a security application to protect your site (a web application firewall, a security plugin or extension) and need to know how efficient it is, or just want to test your own security rules, the Website Security Scanner is exactly what you need.

Basic vs. Intermediate vs. Advanced

"Basic" will simulate very common threats such as SQL injection (SQLi), cross-site scripting (XSS), remote/local file inclusion (RFI/LFI), code injection etc; "Intermediate" will use similar but more complex ones; "Advanced" will include some evasion techniques and obfuscated data often used by hackers to bypass firewalls.
Note that all threats are based on real vulnerabilities that affected most popular web applications over the past few years.

How it works

• The scanner uses the GET, POST and HEAD methods. Make sure you don't block HEAD.
• The scanner will consider that your website successfully blocked the request if it returned a 400, 403, 406, 500 or 503 HTTP code. It will consider that your website failed to block the request if it returned a 200 HTTP code. Any other HTTP code returned by your website will throw an error and the scanning process will stop.
• The scanner will randomly select the tests to run from a list, hence running the scanner more than once may return slightly different results.

IP blacklist / rate limiting

If your security application has a feature to blacklist offending IP addresses or to rate limit them, temporarily disable that feature otherwise the scanning process will be blocked and will throw an error.

Disable caching

If you are running a caching application, disable it during the test.

Beware of false negatives

Some web application firewalls like NinjaFirewall have options to sanitize user input rather than blocking it. When enabled, such option will turn a <script>alert('xss')</script> threat into a harmless <script>alert(\'xss\')</script> string, accept it and return a 200 OK HTTP code. Because it has no way to know whether the threat was sanitized or not, the Website Security Scanner will think that the remote server failed to block it. If this occurs, check your firewall log to see if the data was sanitized or not.

Beware of false positives

A good security application must block threats, but it must not block legitimate traffic. If your website scored poorly, you may be tempted to enable more options in your security application or even to turn its "paranoid mode" on. If you do so, make sure to test your site extensively before starting a scan. Scoring a perfect 5-star rating while blocking legitimate traffic is not a success, it's a failure.

Speed matters

The processing time will be displayed at the top of the results list. Keep an eye on it. If a security application must be efficient, it must be very fast too and must not slow down your site too much. On average, running all tests should take ±30 seconds.

Average results from all users, collected anonymously:

Fair (2.85/5)