Is there a standard way of automatically testing the basic security of my web server? I've found a couple on-line services, (e.g. http://hackertarget.com/), and they seem ok, but I'd like to start off with the basics. Is there a go-to method for stress-testing a web server's security?

1 Answer 1


There are a number of scanners out there which aren't free. Like Nexpose or Nessus which can do way more than just scanning a webserver. But they provide this functionality as well of course.

The interesting part is that these scanners can also log into your server and perform configuration reviews to a certain standard. For instance the DISA STIG is a very good baseline to test against and see if you have properly implemented your webserver in a secure way.

Aside from that, you can also test the application itself, with automated scanners like Burp or Appscan.

Another option would be to use ASV. They are normally only used for PCI-DSS compliance, but you can also use them of course even if you needn't be compliant with PCI-DSS. Their baseline scans and reports are a very good baseline assessment to see what the level of security is, as the PCI-DSS requirements are not light at all.

  • 1
    There is a Nessus Home edition.
    – Gumbo
    Commented Dec 1, 2014 at 11:17
  • @Gumbo true, but it can't be used for commercial purposes though. Although the OP didn't specify this. Commented Dec 1, 2014 at 12:15
  • There is OpenVAS which is an open source fork of Nessus. Commented Dec 1, 2014 at 14:38
  • 1
    yea but that's what his current solution is using. Commented Dec 1, 2014 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .