Skip to content

All about standards scans

A standards scan checks one of your domains against the open internet standards: TLS configuration, DNSSEC, HSTS, IPv6, CAA, security.txt, the modern HTTP security headers, and more.

Wondering what gets checked, why it matters, and how to turn it on? This article explains the toggle, the test set behind it, and the organisational reasons compliance is worth bothering with.

Where to find the toggle

Open one of your domains in Core. The 'Standards Scans' tile sits next to 'Force SSL' and 'QUIC' in the top row of toggles. Click 'Enable' to opt the domain into scans, or 'Disable' to opt out.

Every new domain has it enabled by default, whether you added the domain yourself or it came with a site, a URL redirect, or an n8n instance.

What the scan covers

Non-exhaustively:

  • Transport security — IPv6 reachability of webserver and nameserver, DNSSEC validation, HTTPS availability, HTTP-to-HTTPS redirect, HSTS and its policy parameters, TLS protocol versions (no SSLv2, SSLv3, TLS 1.0 or TLS 1.1), cipher suite selection, key exchange parameters, OCSP stapling, certificate trust chain, hostname match, DANE/TLSA records.
  • Domain configuration — CAA records.
  • HTTP security headers — Content-Security-Policy, Referrer-Policy, X-Content-Type-Options, X-Frame-Options.
  • security.txt — presence and validity of the file at /.well-known/security.txt. See security.txt policies.

Tests that pass regardless of per-domain settings

Some standards are network-level or platform-level, not per-domain. On Cyberfusion these pass for every hosted domain, with no toggle:

  • RPKI — proves to other networks that the IP routes for Cyberfusion's network belong to Cyberfusion, so an attacker cannot redirect traffic by announcing a fake route. Signed across the whole network.
  • IPv6 reachability — the web servers and nameservers are reachable over both IPv6 and IPv4.
  • DNSSEC — zones served by Cyberfusion's nameservers are signed.
  • Modern TLS, ciphers and key-exchange parameters — the webserver config rules out the obsolete protocols and weak ciphers.

The remaining points are yours to control, on the domain or in the application: the attached certificate, HTTP security headers, CAA records, and the security.txt policy.

What automatic scanning changes

With 'Standards Scans' enabled on a domain, that domain is included in Cyberfusion's regular scan runs.

Without automatic scanning, you run a scan yourself, read the report, and act on it — ten domains means ten manual checks. When a setting drifts, for example a certificate is reissued with the wrong ciphers or an HSTS header is dropped during a refactor, nothing tells you until someone runs the test again. With scans on, the drift shows up in the next scan run.

A 100% score is achievable: Cyberfusion is in the public Hall of Fame for hosters that score 100%.

What each standard actually prevents

  • HTTPS, HSTS, modern TLS and DANE — without these, an attacker on the network between your visitor and your server can read or change what is transmitted: banking details, login cookies, form data.
  • DNSSEC — without it, an attacker can poison DNS and silently send your visitors to a fake copy of your site.
  • CAA records — limit which certificate authorities may issue a certificate for your domain. Without one, any CA in the world can issue a certificate for you, and CAs have been compromised more than once.
  • IPv6 — visitors on IPv6-only networks, such as some mobile carriers and large parts of Asia, cannot reach an IPv4-only site at all.
  • CSP, Referrer-Policy, X-Content-Type-Options, X-Frame-Options — block common browser-side attacks: clickjacking, content sniffing, and leaking the user's previous URL to a third party.

security.txt: without it, researchers who find a bug in your site do not know who to tell. See All about security.txt policies.

When compliance is a requirement

Standards compliance is often required to sell to certain customers:

  • (Semi-)government in the Netherlands — the Dutch government's "apply or explain" list of mandatory open standards, published by Forum Standaardisatie. Government bodies, and their suppliers, must comply or document why they do not.
  • EU public sector tenders — these increasingly cite the eIDAS regulation, NIS2, or member-state security baselines. A failing scan is a point against your bid.
  • Healthcare, finance and education — baselines such as NEN 7510, BIO and ISO 27001 reference these same standards. A passing scan is usable evidence during an audit.
  • Public procurement scorecards — some governments publish supplier scores publicly.

Turning scans off

Legitimate reasons to opt out:

  • The domain is internal-only and never reached over the public internet, so the scan cannot reach it and always fails.
  • The domain points at a third-party service, such as a status page or a marketing tool, whose configuration you do not control.
  • You are mid-change and do not want failing results while you work.

Disable the toggle on the domain and it is dropped from the next scan run.