The 17-Module Inspection & Scoring Methodology
WebDefect operates on a strictly non-destructive, read-only inspection protocol. Every reported finding is backed by cryptographic evidence, raw HTTP network traces, and secondary active verification re-probes — completely eliminating disputed third-party scoring.
Passive & RFC-Compliant
We never execute intrusive exploit payloads, brute-force credentials, or modify database states. Every request complies with standard HTTP/2, RFC 8446 TLS, and RFC 1035 DNS specifications.
Cryptographic Host Proof
Legacy rating tools penalize domains for shared AWS/Cloudflare IP addresses that belong to other tenants. We authenticate host identity directly via TLS SNI and SAN certificate chains.
Near-Zero False Positives
Before any finding affects a domain's cyber rating, our engine conducts an automated secondary confirmation re-probe. Flaky connection timeouts and CDN edge hiccups are automatically discarded.
The 0–100 Weighted Scoring Algorithm
Rather than arbitrary penalty drops, our algorithm evaluates domains from a baseline of 100 points, applying calibrated reductions based on the CVSS 4.0 base severity, exploitability vector, and scope of each verified issue.
Hardened Enterprise Defense
Strong Perimeter Posture
Acceptable, Minor Hardening Required
Moderate Risk, Inadequate Headers / DMARC
High Risk, Critical Exposure Identified
Severe Vulnerability / Immediate Threat
CRITICAL (CVSS 9.0–10.0): -25 pts deduction (e.g., exposed .git repo, unauthenticated database backup, active code injection)
HIGH (CVSS 7.0–8.9): -15 pts deduction (e.g., completely absent Content-Security-Policy, plaintext password post, TLS 1.0 active)
MEDIUM (CVSS 4.0–6.9): -7 pts deduction (e.g., DMARC p=none policy, missing SameSite on session cookies, HSTS < 6 months)
LOW (CVSS 0.1–3.9): -3 pts deduction (e.g., server version disclosure banner, missing Permissions-Policy)
Detailed Inspection Phase Catalog
Every scan systematically executes the following phases in automated progression, verifying headers, cryptographic certificates, DNS records, and exposed endpoints.
External Exposure
Maps subdomains, public IP ranges, open service ports, CDN edges, cloud asset buckets, and Certificate Transparency (CT) SAN entries. Every identified asset is corroborated across DNS and TLS handshake proofs — never expanding arbitrary wildcards.
Site Intelligence
Passively traverses the target surface, following HTTP redirect chains, cataloging endpoints, embedded scripts, forms, API references, and external trust anchors without triggering rate limits or disruptive load.
Domain Infrastructure
Inspects authoritative DNS servers for DNSSEC cryptographic chain validation (RRSIG, DNSKEY, DS), CAA record presence, RFC 7208 SPF lookup limits (<10 lookups), DKIM selector alignment, and strict DMARC enforcement (p=reject).
Connection Integrity
Performs full cryptographic handshakes checking protocol version deprecation (TLS 1.0/1.1 denial), cipher suite strength (AEAD algorithms, ChaCha20/AES-GCM), Perfect Forward Secrecy (PFS), OCSP stapling, SAN validity, and HSTS preload eligibility.
Web Protection
Evaluates mandatory security headers: Content-Security-Policy (CSP Level 3 strict-dynamic, script-src, object-src), Strict-Transport-Security (HSTS max-age >= 31536000 with includeSubDomains and preload), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Browser Controls
Parses Set-Cookie directives to enforce Secure, HttpOnly, and SameSite=Strict/Lax flags on session identifiers. Inspects Cross-Origin Resource Sharing (CORS) policies to flag wildcard origin allowances with Access-Control-Allow-Credentials.
Delivery Layer
Analyzes Cache-Control, Surrogate-Control, and Pragma directives to ensure sensitive data, authenticated sessions, and private API responses cannot be stored on shared intermediary CDN edge caches.
Resource Exposure
Safely probes for exposed version control directories (/.git/config), environment variable files (/.env), database backups, Spring Boot Actuator health endpoints, public Swagger/OpenAPI docs, and GraphQL introspection endpoints.
Code Integrity
Scans client-side script bundles for exposed source maps, embedded developer tokens, hardcoded API secrets, and extracts frontend library versions to cross-reference against real-time NIST NVD and OSV vulnerability feeds.
Access & Sessions
Assesses client authentication forms for plaintext submission risk over insecure channels, missing CSRF tokens, unvalidated redirect targets, and client-side password handling policies without submitting actual credentials.
Application Assessment
Audits response banners (Server, X-Powered-By, X-AspNet-Version), stack trace leakage in 404/500 handlers, internal IP disclosure in headers, and debug comments embedded within client HTML markup.
SEO, GEO, AOE
Validates sitemap structure, canonical tag consistency, hreflang declarations, structured data markup, robots.txt directives, and social media card meta tags to ensure accurate discoverability across search, AI-generated content surfaces, and answer engines.
Performance Health
Measures Core Web Vitals indicators, HTTP Archive performance benchmarks, image format optimization (WebP/AVIF), CDN delivery efficiency, and green hosting signals to evaluate load-time posture and environmental footprint.
Privacy Posture
Detects GDPR/CCPA consent mechanisms, AI-generated content signals, typosquatting domain registrations, and brand impersonation patterns to evaluate compliance posture and brand protection coverage.
Security Changes
Compares current cryptographic fingerprints against the organization's historic baseline to identify new asset additions, modified TLS certificates, removed headers, or reappeared vulnerabilities.
Finding Confidence
Every identified condition is subjected to a secondary active verification re-probe. Any intermittent or uncorroborated anomaly is purged, guaranteeing 100% reproducible evidence with raw HTTP response traces.
Risk Intelligence
Correlates disparate findings into root-cause clusters, normalizes severity using CVSS 4.0 exploitability vectors, and applies our mathematical grading formula to compute the final 0–100 cyber rating.
Assessment Scope & Explicit Operational Boundaries
WebDefect is engineered specifically for External Attack Surface Management (EASM) and non-destructive perimeter cyber posture evaluation. To preserve target safety and maintain legal standards, the following explicit boundaries apply:
- Public Surface Only: The engine audits assets reachable over the public Internet. Private VPCs, internal company intranets, and authenticated sessions requiring customer logins are strictly excluded.
- No Exploit Delivery: We identify exposed vulnerabilities (such as publicly readable .env files or missing CSP policies) by observing standard HTTP response codes and headers, without executing intrusive injection attacks or modifying server state.
- Point-in-Time Assurance: External scan results represent the deterministic state at the precise moment of execution. Continuous automated scheduled scanning is recommended to capture configuration drift and certificate renewal events.