> For the complete documentation index, see [llms.txt](https://shellzerox.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shellzerox.gitbook.io/docs/getting-started/running-your-first-scan.md).

# Running Your First Scan

Learn how to initiate a website security scan and review the results in SHELLZERO X.

***

### Overview

SHELLZERO X provides passive website security scanning to help identify publicly observable configuration issues, exposed technologies, and potential vulnerabilities.

A scan can help you understand your website's external security posture and identify areas that may require further investigation.

### Before You Begin

Before starting a scan:

* Identify the website or domain you want to assess.
* Ensure you are authorized to assess the target domain.
* Have access to the domain verification process if additional checks require ownership verification.

### Starting a Scan

1. Open the SHELLZERO X website.
2. Locate the website scanning interface.
3. Enter the domain you want to assess.
4. Follow the on-screen instructions to initiate the scan.
5. Wait for the scan to complete and review the available findings.

The exact interface and available options may vary as the platform evolves.

### Understanding Scan Results

A scan may examine several aspects of a website's publicly observable security configuration.

| Assessment                 | What to Look For                                              |
| -------------------------- | ------------------------------------------------------------- |
| SSL/TLS                    | Certificate issues and encryption configuration.              |
| Security Headers           | Missing or misconfigured HTTP security headers.               |
| Technology Detection       | Publicly exposed software versions and technologies.          |
| Vulnerability Intelligence | Known vulnerabilities associated with detected software.      |
| DNS and Email Security     | Relevant domain records and email protection configurations.  |
| Subdomain Security         | Potentially exposed subdomains and takeover risks.            |
| Reachability               | Website availability, redirects, and detected infrastructure. |

The checks and findings shown depend on the scan results and the capabilities currently available on the platform.

### Reviewing Findings

When reviewing a result:

1. Identify the affected domain, service, or configuration.
2. Read the finding and its supporting details.
3. Determine whether the issue applies to your environment.
4. Prioritize findings according to their severity and potential impact.
5. Verify the issue independently before applying changes.

A detected issue should be treated as a signal for investigation, not automatic proof that a system has been compromised.

### After the Scan

Use the findings to identify configuration improvements and determine which issues need further technical review.

For changes involving encryption, DNS, email security, or server configuration, verify the recommended change against your environment before applying it.

If domain ownership verification is available, complete it when required to access the relevant additional checks.

### Important Limitations

* Passive scanning evaluates publicly observable information and cannot identify every security weakness.
* Some findings may require manual verification.
* A clean scan does not guarantee that a website is secure.
* Scanning a third-party domain without authorization may violate applicable policies or laws.

Use SHELLZERO X as one part of a broader security assessment process.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://shellzerox.gitbook.io/docs/getting-started/running-your-first-scan.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.