Lycan is in development. Checks and scoring may change before 1.0.
Docs
Start a scan
- Open Scan your site.
- Type a domain, like
example.com. A full address such ashttps://example.com/shopworks too; Lycan keeps only the domain. - Confirm that you own the site or have permission to test it.
- Press Start scan. Most scans finish in a few seconds.
Nothing to install, no account. You can run up to six scans a minute.
Read the report
Security score is a letter from A+ to F, with the number of checks that passed.
The perimeter puts your domain in the middle and the six check families around it. A red node needs a fix, amber is low risk, blue is clear. Point at a finding to see where it belongs.
Findings are ranked by risk. Open one to see why it matters, the exact fix to copy, and what Lycan saw.
Download JSON saves the full result on your device, for your records or to share with whoever fixes it.
What Lycan checks
| Family | Check | Why it matters |
|---|---|---|
| HTTPS and HSTS | HTTPS works | Without it, anyone on the network can read or change traffic. |
| HTTPS and HSTS | HTTP redirects to HTTPS | Visitors who type the bare address should never stay on plain HTTP. |
| HTTPS and HSTS | Strict-Transport-Security | Tells browsers to refuse plain HTTP for months at a time. |
| Security headers | Content-Security-Policy | The browser's safety net against injected scripts (XSS). |
| Security headers | Clickjacking protection | Stops other sites from framing your pages to trick clicks. |
| Security headers | X-Content-Type-Options | Stops browsers from running a file as a different type. |
| Security headers | Referrer-Policy | Keeps full addresses from leaking to other sites. |
| Security headers | Permissions-Policy | Locks the camera, microphone and location away from injected code. |
| Cookies and leaks | Cookie flags | Secure, HttpOnly and SameSite protect session cookies from theft. |
| Cookies and leaks | Version headers | Version numbers point attackers to known vulnerabilities. |
| Email spoofing | SPF | Lists the servers allowed to send mail for your domain. |
| Email spoofing | DMARC | Tells receivers to reject mail that pretends to be you. |
| DNS protection | DNSSEC | Signs DNS answers so they cannot be forged. |
| DNS protection | CAA | Limits which authorities may issue certificates for you. |
| Disclosure | security.txt | Gives researchers a published way to report problems. |
How the score works
Every scan starts at 100. Each open finding takes points away by risk: 20 for high, 9 for medium, 3 for low. Informational results, like how many mail servers you have, don't count.
A+ needs 95 or more and no high-risk finding. Then A from 85, B from 70, C from 55, D from 40, and F below that or when the site can't be reached over HTTPS.
The score is a quick signal, not a certificate. A clean scan means the public signals Lycan checks look right, not that the site has no other weaknesses.
What a scan sends
Three page requests to the site, following up to five redirects each:
GET https://your-domain/
GET http://your-domain/ (redirect not followed)
GET https://your-domain/.well-known/security.txtEach request identifies itself, so your logs show who called:
User-Agent: LycanScanner/0.1 (+https://lycansoc.com/scan)DNS records are read through Cloudflare's public resolver, not from your servers. Lycan refuses domains that point to private network addresses, and never scans IP addresses directly.
Safety and privacy
Only scan sites you own or have permission to test. Lycan reads only what any visitor can see, but testing someone else's systems without permission can still be illegal.
Scan results are not stored. They go straight back to your browser and disappear when you close the tab, unless you download them. Cookie values are never read into the report, only their names and flags.