Security
Security scans and protections at the edge
Your origin is scanned directly and compared with your site as visitors get it, and each protection is off until you choose it.
Protections
Protections at the edge, on your terms
Every automation is off until you turn it on. Each protection shows its risk first, and a protection is never added when your site already sends it. You can turn any protection off at any time.
Will security headers break my site?
- They can, which is why each protection is off until you choose it and shows its risk first.
- Most are low risk. HSTS and anti-framing are medium risk.
- HSTS moves up in stages from 5 minutes to 1 year, and browsers remember it until its current stage ends.
- Anti-framing lets you list the sites that may still show your pages in a frame.
Security protections you can turn on
- Baseline headers: no file-type guessing, a stricter Referrer-Policy, a Permissions-Policy and hidden server version numbers.
- HTTPS only (HSTS), raised in stages from 5 minutes to 1 year.
- Anti-framing against clickjacking, with the sites you still allow.
- Upgrade insecure requests and Cross-Origin-Opener-Policy.
- Cookie hardening: Secure and SameSite=Lax where they are missing.
- A security.txt that is renewed automatically.
- Blocking of sensitive files such as .git and .env.
A security protection is only added when your site’s response doesn’t already send it.
Security score
See what BetterEO changes
Your origin is scanned directly, bypassing BetterEO, and compared with your site as visitors get it through BetterEO. The difference is what BetterEO changes.
- Findings are marked as fixed by BetterEO or as needing a change on your site.
- Third-party scripts come with ready-to-paste integrity attributes.
On this site
70 → 95 The security score of bettereo.com, scanned at its origin and then with BetterEO’s protections turned on.
Availability
Is my site down if BetterEO has a problem?
No. Visitors are always forwarded to your own server, so rendering is never in their path. If a page hasn't been rendered yet, or its cached copy is too old or can't be read, crawlers get your server's response, just as they would without BetterEO. BetterEO's edge runs on a global CDN network, so, as with any CDN, your domain's traffic does pass through it.
Our bots
BetterEO’s crawlers name themselves
BetterEO fetches pages with three bots that name themselves in their user agent. BettereoSecurityScanner checks your site’s security headers when you run a security scan. If your site uses bot protection or a web application firewall, allow them, or BetterEO may get a challenge page instead of your content.
BetterEO bots
BettereoRenderer, BettereoAnalyzer and BettereoSecurityScanner, and how to allow them.
Your data: read the privacy policy.
Keep exploring