DEV Community

Cover image for Your Scanner Says B. Here Is What to Fix First.
Stanley A.
Stanley A.

Posted on Originally published at wardenbit.com

Your Scanner Says B. Here Is What to Fix First.

#cloud #devops #webdev #security

Your Scanner Says B. Here Is What to Fix First.

A B from the WardenBit Free Scanner (A-E over 40+ checks) usually means: site works, but 1-2 trust controls are missing. Typical cluster:

  • SSL certificate close to expiring (a truly expired cert usually drops you to C or below — treat it as urgent regardless of grade)
  • No HTTP->HTTPS redirect
  • Missing HSTS
  • Partial SPF/DMARC
  • Cookies without Secure/HttpOnly

Triage order for prod: visitor-blocking first, impersonation second, hardening third.

1. Cert + redirect — verify in 30 seconds 

# cert expiry
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates -subject

# redirect + HSTS in one shot
curl -sI http://example.com | grep -iE 'location|strict-transport'
curl -sI https://example.com | grep -iE 'strict-transport|set-cookie'
Enter fullscreen mode Exit fullscreen mode

If notAfter is past, treat it as urgent regardless of grade — most grading logic already drops an expired cert to C or below. If close, renew now and enable auto-renewal (certbot, host panel, or CDN). Then enforce:

# nginx example
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Enter fullscreen mode Exit fullscreen mode

Start HSTS with short max-age (e.g. 86400), bump to 31536000 after a week with no mixed-content breakage. Confirm every subdomain works over HTTPS before adding includeSubDomains — it applies to all of them. Don't touch preload until you're certain: preload list removal takes months.

2. SPF / DKIM / DMARC — stop brand impersonation

Check what receivers see:

dig +short TXT example.com | grep spf
dig +short TXT _dmarc.example.com
dig +short TXT selector1._domainkey.example.com
Enter fullscreen mode Exit fullscreen mode

Minimum viable DNS:

example.com.      TXT "v=spf1 include:_spf.store-provider.com include:_spf.helpdesk.com ~all"
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1; adkim=r; aspf=r"
Enter fullscreen mode Exit fullscreen mode

Ship p=none first — monitoring only, it blocks nothing. Watch rua reports for a week, confirm your store platform + helpdesk + newsletter all pass alignment, then move to p=quarantine then p=reject. Only an enforced policy stops fakes. CISA CM0055 frames SPF/DKIM/DMARC as restricting initial access via spoofed sender domains. Google/Yahoo (since Feb 2024) and Microsoft (since May 2025) require all three — but only for bulk senders at roughly 5,000+ msgs/day. Below that, set them up anyway: they're your basic anti-impersonation defense at any volume.

3. Cookie flags — 2-line hardening

What you want on session cookies:

Set-Cookie: sessionid=abc123; Path=/; Secure; HttpOnly; SameSite=Lax
Enter fullscreen mode Exit fullscreen mode

Secure = HTTPS-only transport (WSTG-SESS-09). HttpOnly = no document.cookie reads, blunts XSS session theft (does NOT fix XSS itself — OWASP HttpOnly page is explicit on this). Enforce at framework level (e.g. SESSION_COOKIE_SECURE=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE='Lax' in Django; cookie: { secure: true, httpOnly: true, sameSite: 'lax' } in Express), or rewrite at WAF if you can't touch app code. Retest login + cart + checkout after.

Defer deliberately

Full CSP and third-party script integrity audit matter but break checkout fast. Inventory external scripts, drop stale tags, then tighten policy on staging. Same for .env / .git exposure — rare on a B, but if present, block immediately: those paths can leak credentials. Rotate any exposed secrets.

Rescan after each batch, then monthly. A B becomes an A without drama.

Originally published on WardenBit: https://wardenbit.com/posts/scanner-b-grade-what-to-fix-first/?utm_source=devto&utm_medium=organic&utm_campaign=scanner-b-grade-what-to-fix-first

Top comments (0)