Scan API: checks reference
A call to POST /api/v1/scan runs every check by default. To run only some, send categories (whole categories, by the name in grey) and/or checks (single checks). Nothing else runs; categories left out come back as null. Names match without regard to case, and an unknown name is a 400.
curl -X POST https://linkthreatscan.com/api/v1/scan \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com",
"categories": ["email"],
"checks": ["hstsEnforced", "envFileExposed"]}'Every check is true when the site passes it, false when it fails, and null when it could not be determined (a source was unreachable). The same list is available as JSON at GET /api/v1/scan/checks.
No check matches your search.
Domain checks domainChecks
Registration and DNS: DNSSEC, CAA, takeover-prone CNAMEs and the domain's WHOIS status flags.
dnssecEnabledThe registrable domain publishes DS records, so DNSSEC protects its DNS answers from forgery.registrarDeleteProtectionWHOIS shows a delete lock (clientDeleteProhibited or serverDeleteProhibited).registrarUpdateProtectionWHOIS shows an update lock (clientUpdateProhibited or serverUpdateProhibited).caaEnabledCAA records restrict which certificate authorities may issue certificates for the domain.domainExpiredThe registration has not expired (its WHOIS expiry date is in the future).subdomainTakeoverNo CNAME points into a takeover-prone service whose target no longer resolves.domainExpiresSoonThe registration does not expire within the next 30 days.domainInactiveWHOIS does not mark the domain as inactive.domainPendingDeletionThe domain is not pending deletion.domainPendingRestorationThe domain is not pending restoration after deletion.registrarTransferProtectionWHOIS shows a transfer lock (clientTransferProhibited or serverTransferProhibited).registrarDnsResolutionHoldThe registrar has not placed the domain on DNS hold.registryDnsResolutionHoldThe registry has not placed the domain on hold (serverHold).registryRenewalProhibitedThe registry has not prohibited renewing the domain.
Website security websiteSecurity
Response headers and cookies of the scanned page.
serverHeaderNotExposedThe response carries no Server header revealing the web server software.xFrameOptionsSafeX-Frame-Options is DENY or SAMEORIGIN, preventing clickjacking through framing.cspValidA Content-Security-Policy header is set.xContentTypeOptionsSafeX-Content-Type-Options is nosniff, preventing MIME-type confusion.xPoweredByNotExposedThe response carries no X-Powered-By header revealing the framework.referrerPolicyNotUnsafeReferrer-Policy is not unsafe-url, so full URLs are not leaked to other sites.aspNetVersionNotSpecificNo X-AspNet-Version header reveals a specific ASP.NET version.aspNetVersionNotExposedNo X-AspNet-Version header is sent at all.httpOnlyCookiesEnforcedEvery cookie the page sets is HttpOnly, out of reach of page scripts.pageMaintainedThe page answers with a 2xx or 3xx status.cspNoUnsafeInlineThe Content-Security-Policy does not allow 'unsafe-inline'.cspNoUnsafeEvalThe Content-Security-Policy does not allow 'unsafe-eval'.httpsUpgradeDirectiveThe Content-Security-Policy upgrades or blocks insecure requests (upgrade-insecure-requests or block-all-mixed-content).secureCookiesEnforcedEvery cookie the page sets is marked Secure, sent over HTTPS only.permissionsPolicyPresentA Permissions-Policy header restricts browser features such as camera and geolocation.crossOriginOpenerPolicySetA Cross-Origin-Opener-Policy header isolates the page from cross-origin windows.crossOriginResourcePolicySetA Cross-Origin-Resource-Policy header limits which sites may load the page's resources.
Data leakage dataLeakage
Sensitive files and directories that should never be public, probed by path, plus open cloud buckets.
noOpenCloudStorageNo publicly listable S3, Google Cloud Storage or Azure Blob bucket is named after the host.domainIndexNotListableThe page is not a directory listing.envFileExposedNo .env file is served with secrets in it. Probes /.env.gitDirectoryExposedThe .git directory is not served. Probes /.git/HEAD.backupFilesExposedNo site or database backup archive is served. Probes /backup.zip, /db.sql, /website.tar.gz.robotsTxtExposedNo robots.txt is served (one can map out paths meant to stay hidden). Probes /robots.txt.dsStoreExposedNo macOS .DS_Store file, which lists directory contents, is served. Probes /.DS_Store.htaccessExposedThe Apache .htaccess file is not served. Probes /.htaccess.phpInfoExposedNo phpinfo() page revealing the server configuration is served. Probes /phpinfo.php.configFilesExposedNo application configuration file is served. Probes /config.php, /web.config, /config.json.logFilesExposedNo server or application log is served. Probes /error.log, /access.log, /debug.log.databaseDumpsExposedNo database dump is served. Probes /dump.sql, /database.sql, /db.dump, /db.sqlite.adminPanelExposedNo admin panel is open without a login form. Probes /admin, /administrator, /admin/login, /wp-admin.editorFilesExposedNo editor or IDE project file is served. Probes /.vscode/settings.json, /.idea/workspace.xml, /.project.lockFilesExposedNo dependency lock file, revealing exact package versions, is served. Probes /yarn.lock, /package-lock.json, /composer.lock.otherEnvFilesExposedNo environment-specific .env file is served. Probes /.env.local, /.env.production, /.env.development.backupTempFilesExposedNo backup or temporary copy of a source file is served. Probes /index.php.bak, /config.php~, /.env.bak, /wp-config.php.save.editorSwapFilesExposedNo editor swap file is served. Probes /index.php.swp, /.env.swp, /config.php.swo.archiveFilesExposedNo source or site archive is served. Probes /site.tar.gz, /site.zip, /backup.tar, /source_code.zip.privateKeyFilesExposedNo private key file is served. Probes /id_rsa, /id_rsa.pem, /server.key, /private.pem.sqlFilesExposedNo SQL file is served. Probes /backup.sql, /dump.sql, /db.sql.svnHgDirsExposedNo Subversion or Mercurial metadata is served. Probes /.svn/entries, /.hg/requires.shellHistoryExposedNo shell history file is served. Probes /root/.bash_history, /.bash_history, /.zsh_history.awsCredentialsExposedNo AWS credentials file is served. Probes /.aws/credentials.packageManagerConfigsExposedNo package-manager configuration, which can hold registry tokens, is served. Probes /.npmrc, /.pypirc.ftpConfigExposedNo FTP client configuration with stored credentials is served. Probes /.ftpconfig.composerGemFilesExposedNo Composer or Bundler manifest is served. Probes /composer.json, /composer.lock, /Gemfile, /Gemfile.lock.sampleEnvFilesExposedNo sample environment or configuration file is served. Probes /.env.example, /config.example.json, /config.sample.php.readmeDocsExposedNo README or internal documentation is served. Probes /README.md, /readme.txt, /docs/index.html.ignoreFilesExposedNo .gitignore or .dockerignore, which map out the project, is served. Probes /.gitignore, /.dockerignore.apiDocsExposedNo OpenAPI or Swagger description of the API is served. Probes /swagger.json, /openapi.json, /api-docs.sessionCacheFilesExposedNo session or cache file is served. Probes /session.cache, /cache.dat, /sess_123456.buildArtifactsExposedNo build artifact or source map is served. Probes /dist.zip, /build.tar.gz, /main.bundle.js.map.userExportsExposedNo user data export is served. Probes /users.csv, /users.json, /export.xlsx.errorPagesExposedNo error or debug page shows a stack trace. Probes /error, /500, /debug.
Encryption websiteEncryption
The TLS certificate, protocol versions, cipher suites, revocation and HTTPS enforcement.
hstsEnforcedHTTPS responses carry a Strict-Transport-Security header.certificateNotRevokedOCSP (stapled or queried) or the CRL confirmed the certificate is not revoked. false when it could not be confirmed.sslAvailableThe host completes a TLS handshake on port 443.httpRedirectsToHttpsPlain HTTP answers with a redirect to an https:// URL.hostnameMatchesCertificateThe certificate's subject or subject alternative names cover the host name.sslNotExpiredThe certificate has not expired.trustedSslCertificateThe certificate chain verifies against trusted certificate authorities.noInsecureTlsVersionsSSLv2, SSLv3, TLS 1.0 and TLS 1.1 are all refused.sslChainPresentThe server sends its intermediate certificates along with the leaf.sslChainNotExpiringSoonNo certificate in the chain expires within 20 days.sslExpirationPeriodShortThe certificate is valid for under 398 days, the browser limit.sslNotExpiringSoonThe certificate does not expire within 20 days.strongSslAlgorithmThe certificate is signed with SHA-256 or stronger.strongPublicKeyLengthThe key is RSA of 2048 bits or more, or an EC key on P-256, P-384 or P-521.noWeakTls12CiphersTLS 1.2 offers no weak suite (NULL, anonymous, EXPORT, DES, 3DES, RC4 or MD5).tlsRenegotiationSafeThe server supports secure renegotiation.sslCompressionDisabledTLS compression is off (protects against CRIME).certificateTransparencyLoggedThe certificate carries Certificate Transparency proofs, embedded or stapled.ocspMustStapleThe certificate requires OCSP stapling (must-staple).extendedValidationCertificateThe certificate is an Extended Validation (EV) certificate.
Port scan network
A TCP connect scan of common service ports.
openPortsNot a true/false check: the list of open TCP ports found among common service ports. Not scored.
IP / reputation ipDomainReputation
Google Safe Browsing verdicts and AbuseIPDB reports for the host's IPv4 address.
notMalwareProviderGoogle Safe Browsing does not list the host for malware.noMaliciousCodeGoogle Safe Browsing lists the host for none of malware, social engineering or unwanted software.noBotnetActivity30dNo AbuseIPDB report of botnet activity from the host's IP in the last 30 days.noBruteForce30dNo AbuseIPDB report of brute-force attacks in the last 30 days.noMalwareDistribution30dNo AbuseIPDB report of malware distribution in the last 30 days.noUnsolicitedScanning30dNo AbuseIPDB report of port scanning in the last 30 days.notUnwantedSoftwareGoogle Safe Browsing does not list the host for unwanted software.notPhishingPageGoogle Safe Browsing does not list the host for social engineering (phishing).noPhishingActivity30dNo AbuseIPDB report of phishing in the last 30 days.noBotnetActivity90dNo AbuseIPDB report of botnet activity in the last 90 days.noBruteForce90dNo AbuseIPDB report of brute-force attacks in the last 90 days.noMalwareDistribution90dNo AbuseIPDB report of malware distribution in the last 90 days.noUnsolicitedScanning90dNo AbuseIPDB report of port scanning in the last 90 days.
Vulnerability management vulnerabilityManagement
End-of-life server software, certificate weaknesses and known TLS vulnerabilities.
nginxEndOfLifeVersionThe Server header does not name an end-of-life nginx release (1.24 or older).nginx1240HasVulnerabilitiesThe Server header does not name nginx 1.24.0, which has known vulnerabilities.notVulnerableHeartbleednmap's ssl-heartbleed script does not find CVE-2014-0160 (Heartbleed).notVulnerablePoodleSSLv3 is refused (CVE-2014-3566, POODLE).notVulnerableFreakNo EXPORT cipher suite is accepted (CVE-2015-0204, FREAK).notVulnerableLogjamNo Diffie-Hellman group of 1024 bits or fewer is accepted (CVE-2015-4000, Logjam).serverHeaderHiddenNo Server header is sent.apacheEndOfLifeVersionThe Server header does not name an end-of-life or vulnerable Apache release (2.2, 2.4.49, 2.4.50).iisEndOfLifeVersionThe Server header does not name IIS 8 or older.xPoweredByHeaderHiddenNo X-Powered-By header is sent.certificateNotSelfSignedThe certificate's issuer differs from its subject.certificateNotExpiredThe certificate's Not After date is in the future.certificateStrongSignatureAlgorithmThe certificate is not signed with MD5 or SHA-1.certificateKeyLengthThe certificate's public key is at least 2048 bits.notVulnerableCrimeThe TLS session uses no compression (CRIME).notVulnerableDrownSSLv2 is refused (CVE-2016-0800, DROWN).tls10DisabledTLS 1.0 is refused.tls11DisabledTLS 1.1 is refused.noRc4CiphersNo RC4 cipher suite is accepted.no3DesCiphersNo 3DES cipher suite is accepted (Sweet32).notVulnerableRobotnmap's ssl-dh-params script reports nothing vulnerable.notVulnerableTicketbleednmap's ssl-ticketbleed script does not find CVE-2016-9244 (Ticketbleed).noDhWeakParamsnmap reports no weak or anonymous Diffie-Hellman parameters.
Email email
SPF, DMARC, DKIM, MX and BIMI records of the domain.
dmarcPolicyExistsA DMARC record is published at _dmarc.dmarcPolicyNotNoneThe DMARC policy is quarantine or reject, not none.dmarcPolicyPercentDefaultDMARC applies to 100% of mail (no pct below 100).spfSyntaxCorrectThe SPF record starts with v=spf1 and ends with an all mechanism.spfStrictFilteringSPF does not end in ~all (softfail).spfNoPtrMechanismSPF does not use the deprecated ptr mechanism.dmarcRuaSetDMARC names an aggregate report address (rua).dmarcRufSetDMARC names a forensic report address (ruf).dmarcSubdomainPolicyDMARC sets a policy for subdomains (sp).dmarcAlignmentStrictDMARC requires strict SPF and DKIM alignment (aspf=s and adkim=s).spfLookupLimitEvaluating SPF takes at most 10 DNS lookups, the limit receivers enforce.spfNoAllowAllSPF does not allow every sender (+all, ?all or a bare all).spfRecordUniqueThe domain publishes exactly one SPF record.dkimRecordExistsA DKIM key is published under a common selector.dkimKeyLengthThe DKIM key is at least 2048 bits.mxRecordsExistThe domain has MX records.mxNotBareIpNo MX record is a bare IP address.bimiRecordExistsA BIMI record is published, so mail clients can show the brand's logo.
Security engines securityEngines
Threat-intelligence blocklists. An engine this deployment has no credentials for is left out of the result.
artistsAgainst419Not listed by Artists Against 419 (advance-fee fraud sites).certPolskaNot on CERT Polska's list of dangerous domains.openPhishNot in the OpenPhish phishing feed.phishFortNot on PhishFort's blocklist.phishingDatabaseNot on the Phishing.Database list of active phishing domains.phishTankNot a verified phish in PhishTank.phishuntNot in the phishunt.io feed.spam404Not on the Spam404 blocklist.stopForumSpamThe host's IP is not reported to StopForumSpam.tweetFeedNot among indicators shared on TweetFeed this month.urlDnaNot classified as malicious by urlDNA.urlhausNot in abuse.ch URLhaus's list of malware URLs.viriBackNot in ViriBack's C2 tracker.vxVaultNot in VX Vault's list of malware URLs.