From verified URL to continuous checks
1. Add and verify your app (10 minutes)
Add your app URL in KollGuard, then prove you control it — serve a /.well-known/kollguard-verify.txt token file or add a DNS TXT record. KollGuard will not scan a URL you have not verified, so the tool can never be pointed at someone else's site.
2. Run the safe checks (read-only)
KollGuard runs non-destructive GET-only checks against the verified origin: HTTPS enforcement and HSTS, security headers (CSP, X-Frame-Options, nosniff, Referrer-Policy), cookie Secure/HttpOnly/SameSite flags, software-version disclosure, CORS misconfiguration, mixed content, and exposed files (.git, .env, directory listings). No payloads, no exploitation, nothing that modifies your app.
3. Review findings mapped to controls
Each finding lands in your Findings list and posture, mapped to SOC 2 CC6/CC7 and HIPAA §164.312 — the same pipeline as your repo, database, and cloud scans. Transport issues map to transmission security; header and CORS issues map to boundary and logical-access controls.
4. Keep it continuous
Schedule the scan to run on a daily or weekly cadence so a regression — a dropped security header, a newly-exposed file — is caught between releases rather than at your next annual pentest. SOC 2 expects ongoing monitoring, not a once-a-year snapshot.
5. Pair it with an independent pentest
A SOC 2 audit expects an independent, third-party penetration test. This automated scan is the continuous-assurance layer underneath it: it catches the common, mechanical issues early and cheaply, so your paid pentest can focus on logic and depth — and so nothing regresses in the 12 months between engagements.
What it checks
- HTTPS enforced + HSTS
- HTTP → HTTPS redirect
- Content-Security-Policy
- Clickjacking (X-Frame-Options / frame-ancestors)
- X-Content-Type-Options: nosniff
- Referrer-Policy
- Cookie Secure / HttpOnly / SameSite
- Software-version disclosure
- CORS reflect / wildcard-with-credentials
- Mixed content on HTTPS
- Exposed .git / .env / config
- Directory listing + security.txt
Frequently asked
- Is this a replacement for a SOC 2 penetration test?
- No — and KollGuard does not claim it is. A SOC 2 report expects an independent, third-party pentest. This automated scan complements it: continuous, safe checks for the common issues (headers, TLS, cookies, exposed files, CORS) that catch regressions between your annual engagements. Use both.
- Is it safe to run against a production app?
- Yes. Every check is read-only (GET requests), with no exploit payloads, no state changes, a bounded number of requests, and a per-request timeout. It is designed to be safe against production. It only scans the exact host you verified.
- How does KollGuard stop people scanning sites they do not own?
- Ownership is required before any scan. You verify control of the URL via a /.well-known token file or a DNS TXT record, and the scanner hard-refuses any unverified target. Private, loopback, and internal hosts are rejected outright.
- What does it actually check?
- HTTPS enforcement and HTTP→HTTPS redirect, HSTS, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy, cookie Secure/HttpOnly/SameSite flags, software-version disclosure, CORS reflect/wildcard-with-credentials, mixed content, exposed .git/.env/config files, directory listing, and a security.txt best-practice check.
- Where do the findings go?
- Into the same Findings, Risks, and posture views as your repository, database, and cloud scans — mapped to SOC 2 and HIPAA controls — so web issues roll up into one compliance picture and the same evidence export.