Web Security Scanner

Tidal Control's Web Security Scanner grades the security headers of a public website through the MDN Observatory. It is the simplest integration to set up, because it needs no credentials at all: you give it a hostname, and it reports the grade and score that the Observatory assigns.

What this integration monitors

• MDN Observatory grade and score: Whether the host scores above a B, based on its HTTP security headers and HTTPS configuration

Requirements

• Super User role in Tidal Control
• A publicly reachable hostname. The Observatory scans from the internet, so an internal-only host cannot be graded

Configuration step-by-step plan

There is nothing to create in another system. You only add the hostname.

Configuration steps:

1. Configure the integration in Tidal Control

Step 1: Configure the integration in Tidal Control

• Go to Settings → Integrations in Tidal Control
• Click the plus icon next to Web Security Scanner
• Fill in the configuration:
  • Name: A descriptive name, for example Website
  • Host name: The bare hostname, for example example.com
• Click "Create" to save the integration

Configuration fields explained

The integration dialog asks for the following values:

Name:

• A descriptive name for this connection
• For example: Website, Marketing site

Host name:

• The bare hostname to scan, for example example.com
• Required, and must not start with https
• This is the only field. There is no credential, because the Observatory scans public information

Verification

The integration is working when all of the following are true:

• Settings → Integrations shows Web Security Scanner under Configured Integrations
• The Web Security Scanner test is available in the Tests section
• The test result shows a grade and score for your host, and links to the full Observatory report

Frequently asked questions

Do I need an account or API key for the Observatory? No. The scan uses public information about a public host, so there is nothing to authenticate.

Can I scan more than one site? Yes. Add one connection per hostname, each with its own name.

Can it scan an internal application? No. The Observatory reaches your host from the internet. A host behind a VPN or firewall cannot be graded, so use a manual control for those instead.

How do I improve the grade? Follow the recommendations in the linked Observatory report. The usual wins are adding the standard security headers and enforcing HTTPS.

Common problems

"Host must not start with https"

• Remove the scheme. Enter example.com, not https://example.com

"Host is required"

• The field is empty. Enter the hostname to scan

The test reports no score

• The host could not be reached from the internet. Confirm it resolves publicly and serves HTTPS

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.