Know what's actually wrong before someone else finds it.
TXL Aegis scans your live site for real, fixable security gaps — missing headers, weak rate limits, exposed files — and hands you a plain-English grade and a checklist, not a wall of jargon.
Fifteen areas, dozens of checks — all non-destructive, all with a real fix attached.
Most scanners tell you a header is missing. Aegis tests whether your protections actually work — is the CSP strong, is the CDN script pinned, is that old subdomain still pointing at something you don’t own. No exploitation, no credential attacks: every finding ships with the exact config line to change, tagged against OWASP Top 10:2025 and CWE.
CSP quality
Not just “is there a CSP” — flags unsafe-inline, wildcard sources, missing object-src / base-uri, and report-only policies that block nothing.
HSTS & HTTPS upgrade
Checks HSTS strength (max-age, subdomains, preload eligibility) and that plain HTTP is actually redirected to HTTPS.
CORS misconfiguration
Sends a probe from an untrusted origin to see whether your server reflects it — the dangerous case is with credentials allowed.
Headers, cookies & methods
Security headers, Secure / HttpOnly / SameSite cookies, risky HTTP verbs and mixed content — each with the exact fix.
Third-party scripts & SRI
Inventories every outside host your page runs code from, and flags pinnable scripts that are missing Subresource Integrity.
Compromised CDNs
Flags scripts loaded from domains tied to publicly reported supply-chain attacks, like the 2024 polyfill.io incident.
Outdated JavaScript libraries
Spots end-of-life or known-vulnerable jQuery, Bootstrap, AngularJS, Lodash and more — with the CVE and the fix.
Email spoofing
SPF, DKIM and DMARC — whether anyone could send mail that looks like it came from your domain, including policy strength.
DNS & mail hardening
CAA, DNSSEC, MTA-STS and TLS-RPT — the settings most basic scanners never look at.
Domain expiry watch
Warns before your registration lapses — the quiet failure that takes the website and email down together.
Subdomain discovery
Finds subdomains in public certificate-transparency logs and flags internal-looking names that are exposed to the world.
Dangling DNS & takeover risk
Detects DNS records that point at services which no longer exist — the setup behind subdomain takeovers.
Exposed files & open ports
.env, .git and backups; risky services like databases or RDP; and whether a security.txt tells researchers how to reach you.
TLS & legacy protocols
Certificate expiry and chain, plus whether the server still accepts deprecated TLS 1.0 / 1.1.
Rate limiting & brute-force defense
A bounded probe with throwaway credentials checks whether login lockout or throttling exists at all — it never guesses a real password.
Three steps, and you're not waiting on a consultant's calendar.
Scan
I confirm permission first, then run the checks against your live site — a few minutes, nothing invasive.
Grade & fix list
An A–F grade plus a prioritized "what to fix" list — each item with the actual config line, not a vague warning. Exportable as a PDF you can hand to a client or a dev.
Re-verify, or stay on it
Ship the fixes, I re-scan, you get proof it's resolved. Or set it to check itself on a schedule, with an alert if anything regresses.
This is the actual output — grade, priorities, real fixes.
Example data below, not a real client's — this is exactly the format every scan produces.
0 high · 1 medium · 2 low
I ship the sites. I got tired of shipping them unhardened.
TXL Studio builds websites, dashboards, and AI-powered chatbots for businesses. TXL Aegis grew out of a habit from that work: check what I ship, not just that it works. Now it's available as its own thing — for any site, not only the ones I built.
It's not a penetration-testing toolkit and it doesn't pretend to catch everything. It's the fast, honest first pass every live site should get.
Want to check by hand first? Here’s the 9-point website security checklist.
Complimentary with a build. Standalone on its own.
No retainers, no recurring "security platform" fee — just a scan, a fix, and proof it's resolved.
Included, not an upsell
Commission a website, dashboard, or chatbot and the Aegis scan, fixes, and verified report ship with it — no extra charge.
TXL Aegis report
For any live site, built by me or not. I implement the fixes (where you give access), re-scan, and hand over a signed-off "Secured" report to keep or share.