01 / ENCRYPTIONCommunication Encryption
We check certificate validity and expiry, outdated TLS (1.0/1.1), HTTP-to-HTTPS redirects, mixed content, and forms that send data over HTTP.
02 / SECURITY HEADERSSecurity Headers
We check whether HTTP headers that protect visitors' browsers, such as HSTS, CSP, and X-Frame-Options, are set.
03 / EXPOSED FILESFiles That Shouldn't Be Public
We check that files such as the .git folder, .env, and phpinfo.php aren't publicly accessible, and whether a security.txt is in place.
04 / OLD SOFTWAREOutdated Software
We check software versions visible in headers and the meta generator tag, and look for outdated JavaScript libraries.
05 / COOKIES & CORSCookie and CORS Settings
We check cookie Secure/HttpOnly/SameSite attributes, CORS settings that allow any origin, and Subresource Integrity on third-party scripts.
06 / RISK REPORTRisk Levels and Fixes
Each finding comes with its OWASP Top 10 category, a severity level, and concrete steps to fix it.
KNOWN VULNERABILITIESMatching Against Known Vulnerability Data
We read the versions of JavaScript libraries used on the page (such as jQuery, Bootstrap, and Lodash) and check whether they are old versions with known vulnerabilities (CVEs).
The items that can be checked depend on the public information obtainable from your website and the assessment environment. This service cannot discover every vulnerability or information leak.