Aller au contenu principal
W ScanClear
← All guides

Website security: what an audit actually checks

A brochure site's security rarely turns on a firewall. It turns on a handful of HTTP headers, a current certificate, and no secrets left in the code shipped to the browser.

Weight in the score
18/100
checks in this category
37

Why it matters

This is the most heavily weighted category in the score, tied with performance. A missing header breaks nothing visible; it simply leaves a door that nothing closes. Without a Content-Security-Policy, an injected script runs; without HSTS, a visitor can be pushed back to HTTP by an attacker on the network; without X-Frame-Options, the page can be framed for clickjacking. Nearly all of these are fixed server-side, in a few lines of configuration.

The checks that run

The list below is the audit's own, generated from its catalogue — it follows the product rather than describing it from memory.

  • No mixed content (HTTP+HTTPS)
  • No third-party cookies detected (actual browser measurement)
  • No suspicious forms targeting an external domain
  • No SQL injection patterns detected on the client side
  • No dangerous JavaScript patterns detected (eval, unmonitored innerHTML)
  • No obsolete plugins (Flash, Java, ActiveX) detected
  • No issues in the Chrome DevTools Issues panel
  • No scripts detected within an SVG
  • No potential secrets exposed in the code
  • No HTTP Basic authentication detected
  • No JS libraries with known vulnerabilities (retire.js database)
  • No active resources (script/iframe) loaded over unencrypted HTTP
  • Valid and up-to-date SSL certificate
  • Cookies with HttpOnly attribute
  • Cookies with SameSite attribute
  • Secure cookies (Secure, HttpOnly, SameSite)
  • CSP with frame-ancestors directive
  • CSP without unsafe-eval
  • CSP without unsafe-inline
  • HSTS (Strict-Transport-Security) header present
  • CDN stylesheets protected by Subresource Integrity
  • security.txt file present (RFC 9116)
  • Forms submitted via HTTPS only
  • Cross-Origin-Opener-Policy header present
  • Cross-Origin-Resource-Policy header present
  • Permissions-Policy header present
  • Iframes protected by the sandbox attribute
  • The site uses HTTPS
  • target="_blank" links protected by rel="noopener"
  • Content Security Policy (CSP) defined
  • Referrer-Policy defined
  • Clickjacking protection (X-Frame-Options) active
  • MIME-sniffing protection (X-Content-Type-Options) active
  • Sufficiently strict Referrer-Policy
  • CDN scripts protected by Subresource Integrity
  • TLS 1.2+ used
  • Server version not disclosed in headers

Check your site against these

A free scan runs these checks and those of the other 10 categories, and returns the detail of every failure with its fix.

Scan my site for free

Other categories