# Web Security Scanner

> Add a public hostname to Tidal Control and it grades your website's security headers through the MDN Observatory. No credentials and no API key needed.

Source: https://tidalcontrol.com/docs/integrations/web-security-scanner

Tidal Control's Web Security Scanner grades the security headers of a public website through the MDN Observatory. It is the simplest integration to set up, because it needs no credentials at all: you give it a hostname, and it reports the grade and score that the Observatory assigns.

## What this integration monitors

- **MDN Observatory grade and score:** Whether the host scores above a B, based on its HTTP security headers and HTTPS configuration

## Requirements

- Super User role in Tidal Control
- A **publicly reachable** hostname. The Observatory scans from the internet, so an internal-only host cannot be graded

## Configuration step-by-step plan

There is nothing to create in another system. You only add the hostname.

**Configuration steps:**

1. **Configure the integration in Tidal Control**

## Step 1: Configure the integration in Tidal Control

- Go to **Settings → Integrations** in Tidal Control
- Click the **plus icon** next to **Web Security Scanner**
- Fill in the configuration:
  - **Name:** A descriptive name, for example `Website`
  - **Host name:** The bare hostname, for example `example.com`
- Click **"Create"** to save the integration

> **warning:**

**Enter a bare hostname, without a scheme.** Tidal Control rejects a value starting with `https`, so use `example.com` rather than `https://example.com`. Leave off any path as well.

## Configuration fields explained

The integration dialog asks for the following values:

**Name:**
- A descriptive name for this connection
- For example: `Website`, `Marketing site`

**Host name:**
- The bare hostname to scan, for example `example.com`
- Required, and must not start with `https`
- This is the only field. There is no credential, because the Observatory scans public information

## Verification

The integration is working when all of the following are true:

- Settings → Integrations shows Web Security Scanner under **Configured Integrations**
- The Web Security Scanner test is available in the Tests section
- The test result shows a grade and score for your host, and links to the full Observatory report

## Frequently asked questions

**Do I need an account or API key for the Observatory?**
No. The scan uses public information about a public host, so there is nothing to authenticate.

**Can I scan more than one site?**
Yes. Add one connection per hostname, each with its own name.

**Can it scan an internal application?**
No. The Observatory reaches your host from the internet. A host behind a VPN or firewall cannot be graded, so use a manual control for those instead.

**How do I improve the grade?**
Follow the recommendations in the linked Observatory report. The usual wins are adding the standard security headers and enforcing HTTPS.

## Common problems

**"Host must not start with https"**
- Remove the scheme. Enter `example.com`, not `https://example.com`

**"Host is required"**
- The field is empty. Enter the hostname to scan

**The test reports no score**
- The host could not be reached from the internet. Confirm it resolves publicly and serves HTTPS

### Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.

> **info:**

**Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably.