News
Website OPSEC vs App OPSEC: Which Scan Should You Run?
June 6, 2026
Website OPSEC vs app OPSEC is a scan-mode choice on the same public URL, not two different products. Website mode emphasizes marketing-site hygiene: headers, cookies, trackers, robots.txt, mixed content. App mode leans into API and auth discoverability, CORS, HTTP methods, and chatty JSON errors. Most teams with a brochure site plus a product origin should run website mode on the marketing host and app mode on the app host. RoastMyOpsec still only reads public responses — no exploit payloads, no private-network targets.
The practical difference
A marketing site is mostly documents, tags, and CDN rules. Failures look like missing CSP, soft cookies, HTTP assets, and a robots.txt that lists /admin.
An app origin is mostly APIs and sessions. Failures look like reflected CORS, TRACE advertised on OPTIONS, GraphQL introspection left on, and error bodies that include stack traces.
The URL you paste still has to be yours. Localhost and private IPs are blocked.
How to choose based on what you shipped
If customers land on a Next.js or Webflow marketing domain, start with website mode. If they authenticate on app.example.com or api.example.com, run app mode there. If one host does both, run the mode that matches the risk you care about this week, then the other.
| Surface | Better starting mode | Why | Takeaway |
|---|---|---|---|
| Marketing site / blog | Website | Headers, cookies, trackers, mixed content, robots | This is the public costume of the brand |
| SaaS app origin | App | Auth paths, CORS, methods, JSON errors, GraphQL | Still a public URL — not an authenticated pentest |
| Docs + status + app on one host | Website first, then app | Document OPSEC is cheaper to fix at the edge | Do not skip APIs because the blog looks clean |
| GitHub-connected product | Either URL mode, then deepen | Repo secrets and Actions are not visible from HTTP alone | OAuth deepen is optional and scoped |
What both modes refuse to do
Neither mode is hacking. There is no password spraying, no payload injection, no fuzzing. Findings are evidence from headers, HTML, bounded path probes, DNS, and optional GitHub reads you authorize.
That also means a clean scan is not a pentest report. It is a ruthless public-surface roast.
News you can use this week
Teams keep splitting brand sites and apps across hosts, then hardening only the app. Attackers and reporters still screenshot the marketing domain. Scan both. Publish the free score if you want the leaderboard shame; unlock the vault if the blurred findings look expensive.
Common mistakes
The first mistake is scanning the CDN apex and ignoring www or the app subdomain.
The second mistake is treating a 10/10 marketing scan as app security.
The third mistake is pasting a URL you do not own.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Should I run website or app mode?
- Website mode for brochure and content hosts. App mode for origins that serve APIs and login. Many products need both on different hostnames.
- Is this a penetration test?
- No. It is a defensive, consent-based audit of public responses for a URL you assert you control.
- Does GitHub replace the URL scan?
- No. GitHub deepen adds repo-level findings the URL cannot see. Start with the public URL.
Sources
Related guides
News
How to Read an OPSEC Score (1–10) on a Public URLVulnerabilities
App Auth Paths vs Website Login PagesVulnerabilities
CORS Wildcard vs Allowlist for Public APIs