URL Validation — Structure, Protocol & Redirects

Why scanning starts with the URL itself

Before checking anything about your security or performance, PEKRYON first validates the URL you submitted — making sure it's well-formed, uses a proper protocol, and resolves to the site you actually intended to scan. This sounds trivial, but it's an important first step: scanning the wrong version of a URL (an old redirect target, a typo'd domain) would make every other module's results meaningless.

What's checked

• URL structure — confirms the URL is syntactically valid and properly formatted, and notes whether it uses a www. prefix.
• Protocol scheme — confirms whether the URL uses http:// or https://, which matters for every downstream security check.
• Redirect chain — follows any redirects from the submitted URL to see where it actually ends up, so subsequent modules scan the real, final destination.
• IP address as hostname — flags URLs that use a raw IP address (e.g. http://185.23.44.1) instead of a domain name, a pattern strongly associated with phishing and malware.
• Embedded credentials — flags the user:pass@host URL trick, where everything before the @ is discarded by the browser but can visually disguise the real destination.
• Redirect protocol downgrade — checks every hop in the redirect chain, not just the final destination, for a moment where the connection drops from HTTPS back to HTTP.
• Open redirect parameter exposure — flags URL parameters like ?redirect= or ?next= that commonly enable open-redirect abuse if not validated server-side.
• Canonical redirect consistency — does the www/non-www variant of your site actually redirect to the same final destination, or does it independently "work" as its own separate URL? A mismatch here splits SEO signal between two URLs search engines may treat as different sites.