Methodology
SiparSec Methodology v1.0 - October 2026
SiparSec evaluates web security using multiple tools. This page describes what we check and why.
Security Headers Scanner
SiparSec sends a single HTTPS request to the target URL and analyzes the response headers. We do not fetch page content, run scripts, or perform penetration testing. Headers are evaluated for presence, correct configuration, and known insecure values. The header set and categorization follow the OSHP model:
Core Protections
Headers the OSHP recommends for every site, regardless of application type.
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
Contextual Headers
Headers the OSHP considers important depending on your application type and deployment context.
Cache-Control, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy, X-Permitted-Cross-Domain-Policies, X-DNS-Prefetch-Control, Clear-Site-Data
Additional Checks
Beyond presence or absence, SiparSec evaluates header values against known insecure configurations documented by the OSHP, detects server fingerprints that leak technology details, flags deprecated headers, and analyzes Set-Cookie security flags. Domains claiming HSTS preload are cross-referenced against the browser preload list.
TLS/SSL Checker
Connects to the target server on port 443 and analyzes the TLS handshake, certificate, and connection parameters.
SSL (Secure Sockets Layer) was the original protocol for encrypted web connections, developed in the 1990s. TLS (Transport Layer Security) replaced it starting with TLS 1.0 in 1999. All SSL versions are now deprecated and insecure. The industry still uses "SSL" colloquially, but modern encrypted connections use TLS 1.2 or 1.3. SiparSec checks which protocols your server actually supports.
Certificate health (expiry, self-signed detection, hostname match, chain validation), protocol versions (TLS 1.0 through 1.3), cipher strength, and key size.
DMARC/Email Security
Queries DNS records that control how receiving mail servers handle messages from your domain. Checks authentication (SPF, DKIM), policy enforcement (DMARC), mail routing (MX), transport encryption (MTA-STS), and brand indicators (BIMI).
Email spoofing - sending messages that appear to come from your domain - remains one of the most common attack vectors. DMARC, SPF, and DKIM work together to let receiving servers verify that an email actually came from an authorized source. Without these records, anyone can send email as your domain. SiparSec probes DNS to evaluate your domain's email authentication posture.
DMARC policy and reporting (p=reject/quarantine/none, rua, subdomain policy), SPF record and qualifier (-all/~all/+all, redirect chains, lookup count), DKIM selectors (20 common selectors probed), MX records, MTA-STS, and BIMI.
How We Score
Each tool produces a score and a letter grade from F to A+. Scores are calculated using a proprietary algorithm developed by the SiparSec team.
Industry-Adjusted Scoring
Security requirements vary by sector. SiparSec adjusts scoring based on the selected industry profile. The same scan can produce different scores depending on the industry context.
General, Government, Finance and Banking, Healthcare, E-commerce, Telecom
Standards References
Findings are mapped to OWASP Top 10 2025 categories and CWE (Common Weakness Enumeration) identifiers where a direct mapping is accurate. These are citations to industry security standards, not claims of endorsement or certification. Not every finding maps to a CWE - only where a recognized weakness classification applies.
Scope and Limitations
SiparSec evaluates HTTP response headers and TLS/SSL configuration. It does not analyze page content, JavaScript, DNS records, or application logic. Sites behind CDNs or WAFs may return challenge pages instead of real headers, producing a limited scan. Each tool's score reflects its specific dimension, not overall security posture.
Maintenance
The header database, TLS checks, and scoring rules are reviewed periodically for new standards, deprecated patterns, and emerging best practices. Methodology changes are versioned and logged below.
Changelog
v1.0 (October 2026) - Initial release. Security Headers Scanner with OWASP Secure Headers Project analysis, proprietary scoring algorithm, six industry profiles. TLS/SSL Checker for certificate health, protocol versions, and cipher strength. OWASP Top 10 2025 and CWE references on all findings. HSTS preload list verification.
SiparSec is informed by the OWASP Secure Headers Project. OWASP is a registered trademark of the OWASP Foundation. SiparSec is an independent project, not affiliated with or endorsed by OWASP.