Features
The full deep scan spec.
Every check Chalo runs is listed below. New categories ship regularly.
TLS & Transport
- ▸HTTPS reachability
- ▸HTTP → HTTPS redirect
- ▸HSTS header with max-age & preload
Security Headers
- ▸Content-Security-Policy presence + unsafe-inline detection
- ▸X-Frame-Options / CSP frame-ancestors
- ▸X-Content-Type-Options: nosniff
- ▸Referrer-Policy
- ▸Permissions-Policy
Cookies
- ▸Secure flag
- ▸HttpOnly flag
- ▸SameSite policy detection
Exposed Files
- ▸.env, .git/config, .git/HEAD
- ▸wp-config backups, .DS_Store
- ▸phpinfo.php, server-status
- ▸.aws/credentials, config.json.bak
DNS
- ▸A / AAAA / NS records via DoH
- ▸CAA restriction detection
- ▸IPv6 availability
Email Security
- ▸SPF record + weakness detection (+all)
- ▸DMARC policy strength (none / quarantine / reject)
- ▸MX record visibility
Server Fingerprint
- ▸Server: banner leak
- ▸X-Powered-By disclosure
Content Integrity
- ▸Mixed HTTP content on HTTPS pages
- ▸robots.txt presence