Skip to content

Checks and limitations

Every check Värn performs, what it measures and what it cannot see.

Värn performs passive, non-destructive checks of verified domains and websites. That means ordinary DNS lookups, TLS handshakes and HTTP requests to the home page – the same things a web browser or mail server does.

What Värn never does

Try passwords, submit forms, look for hidden pages, exploit vulnerabilities or connect to internal addresses. Redirects are only followed within the verified domain.

Missing safeguard or vulnerability?

Many findings concern missing safeguards, for example that HSTS or Content-Security-Policy is not configured. That does not mean anyone has got in or that there is a confirmed vulnerability – but it makes things easier for an attacker if something else fails. Every finding states which kind it is and how certain the assessment is (confirmed, likely or possible).

All checks

The list below is generated directly from the same catalogue the product uses, including the limitations that apply to each check.

Encrypted connection

HTTPS available

https.available

Checks that the website responds over encrypted HTTPS (port 443): a TLS connection can be established and a page can be fetched.

  • The website is not reachable over HTTPS · High

Limitations: Only the start page (/) is fetched. Transient network issues or firewalls blocking our scanner may cause false results; a single failure should be confirmed by the next scan.

TLS protocol version

tls.protocol

Records the negotiated TLS version and cipher and, using a separate connection, tests whether the server still accepts the deprecated TLS 1.0 and 1.1.

  • Deprecated TLS versions (1.0/1.1) are enabled · Medium

Limitations: The legacy test requires the scanner's own TLS library (OpenSSL) to be able to offer TLS 1.0/1.1. If it cannot, the result is reported as "not testable" rather than as a finding. SSL 3.0 and individual weak ciphers are not tested.

HTTP to HTTPS redirect

http.https_redirect

Checks that visitors who go to the unencrypted address (http://) are automatically sent to HTTPS.

  • Plain HTTP is not redirected to HTTPS · Medium

Limitations: Only the start page is checked. A closed port 80 counts as a pass. Redirects to domains other than the verified domain are not followed.

Certificate

Valid TLS certificate

tls.certificate_valid

Checks that the certificate is issued by a trusted certificate authority, matches the domain name and has not expired.

  • The TLS certificate is not valid for the website · High
  • The TLS certificate has expired · Critical

Limitations: Trust is evaluated against the root store bundled with Node.js; individual browsers or older devices may differ. Revocation (OCSP/CRL) is not checked.

Certificate expiry

tls.certificate_expiry

Calculates the number of days until the certificate expires and warns well before the expiry date.

  • Certificate expires soon · Medium

Limitations: Only the certificate presented to our scanner is checked. Other servers behind the same name (e.g. in a load balancer pool) may serve different certificates.

Security headers

HSTS (Strict-Transport-Security)

headers.hsts

Checks that the website instructs browsers to always use HTTPS via the Strict-Transport-Security header.

  • HSTS is missing · Medium
  • HSTS lifetime is too short or the header is malformed · Low

Limitations: The header is checked on the HTTPS response for the scanned address. Presence on the browser preload list is not verified separately.

Content Security Policy

headers.csp

Checks whether the website has a Content Security Policy (CSP) restricting which scripts and resources the browser may run, and whether the script policy is strict enough.

  • Content Security Policy is missing · Medium
  • Content Security Policy provides weak script protection · Low
  • Content Security Policy is in report-only mode · Low

Limitations: Only the policy in HTTP headers on the start page is assessed; policies in <meta> tags or on other pages are not seen. The assessment focuses on script sources and is not a full policy review.

X-Content-Type-Options

headers.content_type_options

Checks that X-Content-Type-Options: nosniff is sent so the browser does not guess file types.

  • X-Content-Type-Options: nosniff is missing · Low

Limitations: Only the start page response is checked. Other files (e.g. uploaded documents) may lack the header.

Framing protection (clickjacking)

headers.frame_protection

Checks that the website declares which sites may display it in a frame, via X-Frame-Options or the CSP frame-ancestors directive.

  • Framing (clickjacking) protection is missing · Low

Limitations: Only the start page is checked. Pages intentionally designed to be embedded (e.g. widgets) may warrant a different decision.

Referrer-Policy

headers.referrer_policy

Checks that the website controls how much of the page address is passed on to other sites when visitors follow links.

  • Referrer-Policy is missing or too permissive · Low

Limitations: Modern browsers have a reasonable default without the header, but older browsers and embedded web views may behave differently. Only the start page is checked.

Version information in response headers

headers.information_disclosure

Checks whether the server reveals software names and version numbers in headers such as Server and X-Powered-By.

  • Server reveals software version · Low

Limitations: We do not match the version against known vulnerabilities and do not claim any specific vulnerability exists. The version string may also be stale or deliberately misleading.

Cookies

Cookie security attributes

cookies.attributes

Checks that cookies set by the website carry the Secure, HttpOnly and SameSite attributes. Cookie values are never read or stored.

  • Cookie lacks security attributes · Low

Limitations: Only cookies set directly in the start page response (and its in-domain redirects) are seen. Cookies set after login, by JavaScript or by third parties are not checked. A missing HttpOnly flag may be intentional for cookies read by JavaScript.

Email security

SPF (Sender Policy Framework)

email.spf

Checks that the domain has exactly one SPF record specifying which servers may send email for it, and how strict the policy is.

  • SPF record is missing · Medium
  • Multiple SPF records published · Medium
  • SPF allows all senders (+all) · High
  • SPF policy is neutral (?all or no all) · Low

Limitations: We evaluate the final all rule and follow redirect= up to three levels. We do not verify that all of your legitimate sending services are included.

SPF – DNS lookup count

email.spf_lookups

Counts SPF mechanisms that require DNS lookups (include, a, mx, ptr, exists, redirect). The standard allows at most ten.

  • SPF record requires too many DNS lookups · Low

Limitations: Only top-level terms are counted; lookups inside included records (e.g. include:spf.protection.outlook.com) are not. The real total may therefore be higher.

DMARC

email.dmarc

Checks that the domain has a DMARC policy telling receiving mail servers what to do with email that claims to come from you but fails SPF/DKIM.

  • DMARC policy is missing · Medium
  • DMARC is in monitoring mode only (p=none) · Low
  • DMARC record is invalid · Medium

Limitations: We read the published policy but cannot see how receivers actually handle mail. For privacy only the number of report addresses and their domains are stored, not full addresses.

DKIM

email.dkim

Looks for published DKIM keys under a set of common selectors (e.g. selector1/selector2 for Microsoft 365 and google for Google Workspace).

Limitations: DKIM selectors cannot be enumerated via DNS – they can have any name. Not finding a key therefore does not mean DKIM is missing and never creates a finding. Key length is an estimate based on the key size.

DNS

MX records

dns.mx

Records which mail servers (MX) receive email for the domain.

Limitations: Informational. Without MX records the domain probably does not receive email; SPF (v=spf1 -all) and DMARC (p=reject) are still recommended to prevent the domain from being abused as a sender.

CAA records

dns.caa

Records whether the domain restricts which certificate authorities may issue certificates for it (CAA).

Limitations: Informational. Missing CAA is common and does not create a finding, but we recommend CAA as extra protection against mis-issued certificates. Only the verified domain is checked.

DNS snapshot

dns.records

Stores A, AAAA and NS records for the address so unexpected changes (e.g. hijacked DNS or a provider move) can be detected between scans.

Limitations: Informational. Records are fetched via public DNS resolvers and may vary with geographic load balancing.

When a check cannot be carried out

If a check cannot be carried out – for example because the server does not respond – the result is shown as Could not be checked with an error code. It never counts as passed, and findings are never closed automatically because of a check that could not run.