If you've never run a security scan, the concept can feel vague. What exactly is being tested? Is it looking inside your server, or just from the outside?
Passive vs. active checks
Passive checks look at publicly available information without making unusual requests to your server — DNS records, reputation databases, certificate transparency logs, HTTP response headers.
Active checks probe your server directly — scanning ports, testing cipher suites, checking for specific vulnerabilities. These require the server to be yours.
threatprobe.app's free scan is primarily passive (with some light direct requests). Basic and Full add active scanning.
What gets checked
Security headers — HTTP headers that tell browsers to apply protections: Content Security Policy, HSTS, X-Frame-Options, and others.
TLS/SSL — which protocol versions your server accepts, whether your certificate is valid, and in deeper scans, which cipher suites are offered.
DNS & email security — SPF, DKIM, and DMARC records that prevent email spoofing.
Exposed files — common sensitive paths (.env, .git, backups, config files) checked for accessibility.
Server disclosure — response headers checked for software and version information.
Reputation — your domain and IP checked against blocklists and safe-browsing databases.
Open ports — exposed services, from public data (free) or a live scan (Basic/Full).
CMS & software fingerprint — your technology stack identified, known-vulnerable versions flagged.
Breach exposure — your domain checked against known breach databases.
What a scan can't do
A scan from the outside can only see what an attacker could see. It can't check your database configuration, application code, or internal network. For a comprehensive review, a penetration test is a separate engagement.