Documentation

Everything the scanner sees, explained.

Chalo is opinionated about what a modern web security baseline looks like. These docs describe what we check, why it matters, and exactly how to fix it — in the language of the config files you already edit.

Scan lifecycle

Every scan fans out TLS discovery, header analysis, exposure probing, cookie inspection, and DNS/email reputation in parallel. Results stream into a graded report in under 30 seconds — no queue, no email-me-later.

Severity model

Findings are graded Critical → Info. Critical means live exploitability, High is a broken control, Medium is a hardening gap, Low and Info are hygiene signals. Your composite score is weighted so one Critical can't hide behind ten passes.

Remediation playbooks

Every failing finding ships with a copy-paste fix: header snippets for Nginx, Caddy, Cloudflare Workers and Vercel, plus DNS record templates for SPF, DKIM, DMARC, MTA-STS and CAA. No 'consult your security engineer' hand-wave.

API access

POST { "url": "example.com" } to /api/public/scan and get the full JSON report back. Free tier is rate-limited per IP; Pro unlocks authenticated deep scans, scheduled monitoring, and webhook delivery on grade changes.

What we actually check

Seven independent categories, ~40 individual checks, weighted into a single grade. Every check is deterministic and reproducible — the same URL scanned twice produces the same findings.

TLS & Transport

Certificate validity, HTTPS reachability, HTTP → HTTPS upgrade path across redirect chains, and TLS version signals.

Security Headers

HSTS, CSP (including 'unsafe-inline' detection), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Cookies

Per-cookie audit for Secure, HttpOnly, and SameSite flags — with the actual cookie names surfaced so you know exactly what to fix.

Server Fingerprint

Detects leaked Server and X-Powered-By banners that give attackers a head start on version-specific exploits.

Exposed Files

Probes for .env, .git/config, .DS_Store, server-status, phpinfo.php, aws credentials and other classic leak paths.

DNS & IPv6

A/AAAA/NS discovery, CAA enforcement to lock down which CAs may issue certs for your domain, and IPv6 readiness.

Email Security

SPF policy strictness (rejects +all), DMARC presence and enforcement level (none / quarantine / reject), and MX inventory.

Reading your grade

Grades are weighted by severity, not counted equally. One Critical drops you two letter grades on its own — this isn't a checklist you can pad with passes.

Grade	Score range	What it means
A	90 – 100	Production-grade security posture. Keep monitoring for drift.
B	75 – 89	Solid baseline with one or two hardening gaps to close.
C	60 – 74	Meaningful weaknesses — schedule remediation this sprint.
D	40 – 59	Multiple broken controls. Attackers with a scanner will notice.
F	0 – 39	Critical exposure. Fix before anything else ships.

Public API

Anonymous scans are available over a simple JSON API. No key required for the free tier — just a fair-use rate limit per IP.

Request

curl -X POST https://chalo.dev/api/public/scan \
  -H "content-type: application/json" \
  -d '{"url":"example.com"}'

Response

{
  "target_url": "https://example.com/",
  "hostname": "example.com",
  "score": 72,
  "grade": "C",
  "findings": [ ... ]
}

Embeddable badge

<a href="https://chalo.dev/scan/<id>">
  <img src="https://chalo.dev/api/public/badge.svg?score=92&grade=A" alt="chalo.dev security" />
</a>

Frequently asked

Do you store the sites I scan?

Anonymous scans are ephemeral — the report lives in your browser session only. Signed-in scans are stored under your account and are private by default; you choose whether to publish a shareable report.

Will scanning trip a WAF or rate limiter?

Chalo issues a small number of read-only HTTP requests from a single IP with a labeled User-Agent (ChaloScanner/1.0). We never brute-force, fuzz, or attempt exploitation.

How do you handle authenticated apps?

Public scans only see what a logged-out visitor sees. Pro accounts can supply a session cookie or bearer token to authenticate the crawl for internal dashboards and admin surfaces.

Can I white-label reports for clients?

Team and Enterprise plans include branded PDF exports, custom domains for shared reports, and an embeddable score badge with your logo.