Security
Security header problems
Read from response headers and markup already fetched — never by probing. These are one-line changes with no downside, which is why their absence is usually an oversight rather than a decision.
11 checks · 7 with framework-specific fixes
Every check on this surface
- I found an API key in my page sourceNo secret or sandbox keys in the page source · weight 9
- How to fix mixed content warningsNo insecure subresources · weight 9
- How to add a Strict-Transport-Security headerStrict-Transport-Security is set · weight 8
- How to add a Content-Security-PolicyContent-Security-Policy is set · weight 7
- Secure, HttpOnly and SameSite cookie flags explainedCookies carry the right flags · weight 7
- How to find outdated front-end libraries on my siteNo known-outdated front-end libraries · weight 6
- Which baseline security headers should I setBaseline security headers · weight 6
- How to add subresource integrity to third-party scriptsThird-party scripts pinned with integrity · weight 4
- How to stop advertising software versions in headersNo exact software versions in headers · weight 3
- Why external links need rel=noopenerExternal links use rel=noopener · weight 3
- What is security.txt and should I have onesecurity.txt for vulnerability reports · weight 2
Check all of this against your own site
The audit runs these together with the other groups and returns what failed, what it costs you, and the fix for your framework.
No signup. Results in 30 seconds.