twa [-wvcsdV] DOMAIN
twa takes a DOMAIN hosting a website and performs a short security audit. It can be used to detect HTTP(S) issues, missing security headers, information-leaking headers, and other potential security hazards.
twa takes only one DOMAIN at a time. If you need to audit multiple sites, run the program again.
Perform the audit on the main DOMAIN and the www. subdomain.
Emit output in CSV.
Run testssl-based checks (skipped by default)
Disable scanning common development ports
Print the version and exit.
Print a help message and exit.
Don't colorize output, even when on a TTY.
The maximum length, in seconds, for internal curl calls.
The User-Agent to use for all curl calls.
Any additional options to pass to curl calls.
Each line of output describes the result of a single test, and follows the "RESULT(DOMAIN): explanation" format, where RESULT is one of the following:
The test passed with flying colors.
The test passed, but with one or more things that could be improved.
The test failed, and should be fixed.
The server gave us something we didn't understand.
The server gave us something we understood, but that we don't handle yet.
A really important test failed, and should be fixed immediately.
None known. File issues at: https://github.com/trailofbits/twa
twa is maintained by William Woodruff (<william @ trailofbits.com>).