Scan lifecycle
A scan performs read-only HTTP and DNS checks, then returns a graded report. Completion time depends on the target and network responses.
Documentation
Everything the scanner sees, explained.
Chalo is opinionated about what a modern web security baseline looks like. These docs describe what we check, why it matters, and exactly how to fix it — in the language of the config files you already edit.
Severity model
Findings use Critical, High, Medium, Low, Info, and Pass labels. Severity reflects Chalo's configured risk weighting and should be reviewed in the target's context.
Remediation playbooks
Failing findings include an explanation and remediation guidance. The check library adds focused examples for supported transport, header, SPF, and DMARC checks.
API access
POST { "url": "example.com" } to /api/public/scan to receive the current public JSON report. Managed keys, schedules, webhooks, and published usage limits are not available yet.
What we actually check
The scanner groups observations into eight categories and computes one summary grade. Results can change when the target or network response changes.
TLS & Transport
Certificate validity, HTTPS reachability, HTTP → HTTPS upgrade path across redirect chains, and TLS version signals.
Security Headers
HSTS, CSP (including 'unsafe-inline' detection), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Cookies
Per-cookie audit for Secure, HttpOnly, and SameSite flags — with the actual cookie names surfaced so you know exactly what to fix.
Server Fingerprint
Detects leaked Server and X-Powered-By banners that give attackers a head start on version-specific exploits.
Exposed Files
Probes for .env, .git/config, .DS_Store, server-status, phpinfo.php, aws credentials and other classic leak paths.
DNS & IPv6
A/AAAA/NS discovery, CAA enforcement to lock down which CAs may issue certs for your domain, and IPv6 readiness.
Email Security
SPF policy strictness (rejects +all), DMARC presence and enforcement level (none / quarantine / reject), and MX inventory.
Reading your grade
Grades summarize weighted findings across the current checks. Use the evidence and remediation inside each finding rather than treating the letter as a certification.
| Grade | Score range | What it means |
|---|---|---|
| A | 90 – 100 | Production-grade security posture. Keep monitoring for drift. |
| B | 75 – 89 | Solid baseline with one or two hardening gaps to close. |
| C | 60 – 74 | Meaningful weaknesses — schedule remediation this sprint. |
| D | 40 – 59 | Multiple broken controls. Attackers with a scanner will notice. |
| F | 0 – 39 | Critical exposure. Fix before anything else ships. |
Public API
Anonymous scans are available over a simple JSON API. No key is currently required; published quotas and managed API keys are not yet available.
Request
curl -X POST https://chalo.dev/api/public/scan \
-H "content-type: application/json" \
-d '{"url":"example.com"}'Response
{
"target_url": "https://example.com/",
"hostname": "example.com",
"score": 72,
"grade": "C",
"findings": [ ... ]
}Embeddable badge
<a href="https://chalo.dev/scan/<id>">
<img src="https://chalo.dev/api/public/badge.svg?score=92&grade=A" alt="chalo.dev security" />
</a>Frequently asked
Do you store the sites I scan?
Anonymous scans are ephemeral — the report lives in your browser session only. Signed-in scans are stored under your account and are private by default; you choose whether to publish a shareable report.
Will scanning trip a WAF or rate limiter?
Chalo issues a small number of read-only HTTP requests from a single IP with a labeled User-Agent (ChaloScanner/1.0). We never brute-force, fuzz, or attempt exploitation.
How do you handle authenticated apps?
Chalo currently observes only what a logged-out public visitor can reach. Authenticated crawling is not supported.
Can I export or share a report?
Saved reports can be made public, result data can be downloaded as JSON, and a dynamic SVG grade badge can be embedded. Branded PDF exports are not available.