Documentation & Technical Guide
Everything required to orchestrate perimeter scans, integrate continuous CI/CD security gating, interpret cryptographic proof, and achieve Grade A cyber posture.
Getting Started & Running Scans
Execute your first autonomous perimeter audit and understand report generation.
Q:How do I trigger an on-demand audit?
Navigate to the WebDefect scanner, input any fully-qualified domain name (e.g., yourcompany.com) or public IP address, and click Run Audit. The scanner begins a 17-module audit pipeline across 645 distinct automated checks, outputting streaming telemetry and completing in less than 60 seconds.
Q:Do I need to install any agent or change DNS records?
No. WebDefect is 100% agentless and requires no DNS TXT challenges, server daemon installations, or external firewall holes. All inspections are performed externally from our distributed scanning probes.
Q:Can I automate scans within our CI/CD deployment pipeline?
Yes. You can trigger an audit via our webhook API at the end of staging or production deployments to prevent security regressions or missing security headers before release.
curl -X POST "https://webdefect.com/api/audit/start" \
-H "Content-Type: application/json" \
-d '{"domain": "app.yourcompany.com", "scanMode": "standard"}'Interpreting Ratings & CVSS 4.0 Findings
How scores are calculated, evidence is structured, and severities are assigned.
Q:How is the 0–100 Cyber Rating computed?
The score reflects your perimeter resistance against external threat actors. Domains start at 100 points, with deductions calibrated to CVSS 4.0 exploitability vectors (-25 pts for Critical, -15 pts for High, -7 pts for Medium, -3 pts for Low). A rating of 93+ corresponds to a Grade A security posture.
Q:What is the difference between Detected vs. Verified?
A 'Detected' finding indicates strong heuristic signals were observed during the crawl. A 'Verified' finding means our engine performed an active secondary re-probe and captured concrete cryptographic or HTTP response proof.
Q:How does WebDefect eliminate false positives?
Unlike legacy scoring firms that penalize tenants for shared IP blocks (like Cloudflare or AWS ELBs), WebDefect correlates evidence directly through TLS Server Name Indication (SNI) and cryptographic Subject Alternative Name (SAN) chains. If an issue cannot be deterministically proven against your exact host, it is discarded.
Regulatory & Compliance Mapping
Map perimeter inspection findings directly to SOC 2, ISO 27001, and PCI-DSS v4.0 controls.
Q:Which compliance standards are covered by WebDefect?
Our checks map directly to SOC 2 Type II (Common Criteria 6.6, 6.7, 7.1, 7.2), ISO/IEC 27001:2022 (Annex A.8.8 Management of Technical Vulnerabilities), PCI-DSS v4.0 (Requirement 6.4 Public-Facing Web Applications), and NIST CSF 2.0 (PR.IP, DE.CM).
Q:How do I provide evidence to auditors or insurance underwriters?
Export the comprehensive Executive PDF or raw JSON report from any completed audit. The report includes tamper-evident cryptographic hashes, timestamped RFC responses, and specific remediation confirmation for auditor handoff.
Remediation & Turnkey Code Snippets
Copy-paste security configuration templates for Nginx, Caddy, Cloudflare, and DNS.
Q:How do I fix missing HTTP Security Headers in Nginx?
Add the following hardened header block to your server or location context:
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
Q:How do I enforce strict DMARC rejection in DNS?
Publish a TXT record under the _dmarc subdomain of your root zone:
_dmarc.yourcompany.com. 300 IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc-reports@yourcompany.com;"
Need dedicated SOC or custom API integration support?
Our perimeter security engineering team assists enterprises with bespoke asset inventory integration, customized CVSS weighting, and air-gapped deployment configurations.