Our passive scanning methodology

Principles

• Passive and non-intrusive: we make the same kinds of requests a normal visitor's browser makes, plus public DNS lookups.
• Authorised only: free scans need a confirmation that you own the domain or are authorised to request a scan. Paid reports need ownership verification by DNS TXT record or file upload.
• Evidence-based: every finding records what we observed, such as a header value, a cookie name or a DNS record.

Free mini-scan

1. One GET request to the homepage over HTTPS, following redirects, plus one request over HTTP to check the redirect.
2. Response headers checked: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, plus Server / X-Powered-By disclosure.
3. Set-Cookie headers on that first response, and their Secure, HttpOnly and SameSite flags.
4. The HTML is searched for signatures of common analytics and advertising tags and consent-management platforms, and for a privacy-notice link.
5. DNS-over-HTTPS lookups for the SPF (TXT) and DMARC (_dmarc TXT) records.
6. On-page SEO signals: title, meta description, H1 count, canonical, viewport, lang, JSON-LD.

Full Scan Report adds

• A real-browser visit to up to 10 pages with no consent given, recording every cookie and third-party request; then the same after accepting and after rejecting
• An automated check of whether the privacy notice mentions the items common PDPPL / GDPR / QFC checklists expect
• A review of forms and marketing opt-ins
• After ownership verification only: checks for a short list of commonly exposed paths (e.g. /.git/HEAD, /.env), and /.well-known/security.txt
• DKIM lookups for common selectors, MX and TLS certificate details
• Local SEO and structured data review

Never in scope

• Exploitation, payload injection, fuzzing or brute force
• Logging in, or testing authenticated areas
• Load or denial-of-service testing
• Scanning third-party domains you don't control

Severity grading

Severity	Meaning	Example
High	Likely to expose data or enable abuse, or a clear gap against a published requirement	Form posting over HTTP; marketing pixel firing before consent; exposed .env
Medium	Weakens defences; should be fixed soon	No HSTS; DMARC missing; session cookie without HttpOnly
Low	Hardening or best practice	No Permissions-Policy; server version disclosed

Standards referenced

OWASP Top 10:2025; Qatar PDPPL; QFC DP Regulations 2021; EU GDPR; Google's sender requirements for SPF/DKIM/DMARC. Referencing a standard doesn't mean we are certified against it.

Internal tooling

The scanner is part of the internal security and compliance tooling Samtaro uses on its own projects. It is adapted here as a passive, consent-gated service. See About.