Documentation & Technical Guide
Everything required to run security assessments, integrate continuous security monitoring, interpret findings with evidence, and achieve strong security posture.
Getting Started & Running Scans
Execute your first comprehensive security assessment and understand report generation.
Q:How do I trigger an on-demand audit?
Navigate to the WebDefect scanner, input any fully-qualified domain name (e.g., yourcompany.com) or public IP address, and click Run Audit. The platform performs a comprehensive security assessment across 17 specialized areas, providing real-time progress updates. Most assessments complete in under 90 seconds depending on target complexity.
Q:Do I need to install any agent or change DNS records?
No. WebDefect is fully agentless and requires no DNS TXT challenges, server installations, or firewall modifications. All assessments are performed externally using standard web protocols.
Q:Can I automate scans within our CI/CD deployment pipeline?
Yes. You can trigger an audit via our webhook API at the end of staging or production deployments to prevent security regressions or missing security headers before release.
curl -X POST "https://webdefect.com/api/audit/start" \
-H "Content-Type: application/json" \
-d '{"domain": "app.yourcompany.com", "scanMode": "standard"}'Interpreting Ratings & CVSS 4.0 Findings
How scores are calculated, evidence is structured, and severities are assigned.
Q:How is the 0–100 Cyber Rating computed?
The score reflects your perimeter resistance against external threat actors. Domains start at 100 points, with deductions calibrated to CVSS 4.0 exploitability vectors (-25 pts for Critical, -15 pts for High, -7 pts for Medium, -3 pts for Low). A rating of 93+ corresponds to a Grade A security posture.
Q:What is the difference between Detected vs. Verified?
A 'Detected' finding indicates a security issue was identified during the assessment. A 'Verified' finding means the issue was confirmed through secondary validation and includes concrete evidence from your infrastructure.
Q:How does WebDefect eliminate false positives?
Unlike legacy scoring firms that penalize tenants for shared IP blocks (like Cloudflare or AWS ELBs), WebDefect correlates evidence directly through TLS Server Name Indication (SNI) and cryptographic Subject Alternative Name (SAN) chains. If an issue cannot be verified with concrete evidence against your exact host, it is discarded.
Compliance Framework Alignment
Findings are mapped to OWASP Top 10, PCI-DSS v4.0, and NIST CSF controls for audit support.
Q:Which compliance frameworks does WebDefect align with?
Our security checks are mapped to industry-standard frameworks including OWASP Top 10 2021, PCI-DSS v4.0 (Requirement 6.4 Public-Facing Web Applications), and NIST CSF 2.0 (PR.IP, DE.CM). This mapping helps organizations understand how detected findings relate to compliance requirements. Note: WebDefect is not certified under any compliance framework; organizations requiring formal certification should consult with qualified auditors.
Q:How do I provide evidence to auditors or insurance underwriters?
Export the complete Executive PDF or raw JSON report from any completed audit. The report includes timestamped evidence, detailed findings, and specific remediation guidance for auditor review.
Remediation & Turnkey Code Snippets
Copy-paste security configuration templates for Nginx, Caddy, Cloudflare, and DNS.
Q:How do I fix missing HTTP Security Headers in Nginx?
Add the following hardened header block to your server or location context:
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
Q:How do I enforce strict DMARC rejection in DNS?
Publish a TXT record under the _dmarc subdomain of your root zone:
_dmarc.yourcompany.com. 300 IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:[email protected];"
Need dedicated SOC or custom API integration support?
Our perimeter security engineering team assists enterprises with bespoke asset inventory integration, customized CVSS weighting, and air-gapped deployment configurations.