Security guide
Website security checklist: the 35 checks a scan runs
Protects your site and your visitors from hackers, data leaks, and scams.
Last updated:
Most break-ins on small sites are not clever. They come through a missing header, a forgotten backup file, an old JavaScript library or a form that accepts anything. Each item below is one thing the scanner checks on your live site, in plain language, and whether it runs on the free scan.
11 of these 35 checks run on the free scan, with no account. The other 24 run on Pro.
- 1
Browser security rules
FreeSpecial instructions that tell browsers how to keep your visitors safe.
- 2
Secure connection (SSL)
FreeThe padlock in the address bar. It encrypts data between your site and visitors.
SSL/TLS certificate: The digital certificate that enables the padlock and encrypts traffic to your site.
Why it matters: A valid, current certificate is what makes a connection trusted and private.
- 3
Forces secure connection
FreeMakes sure visitors always land on the secure (https) version of your site, at one address (www or not).
- 4
Email anti-spoofing
FreeStops scammers from sending fake emails that look like they come from your domain.
- 5
Exposed private files
FreeChecks that sensitive files (passwords, backups, config) are not publicly downloadable.
- 6
Next.js weak spots
FreeIf your site runs on Next.js, checks whether its login gate can be skipped with a known header trick (CVE-2025-29927) and whether it announces the framework.
Middleware bypass: A flaw in Next.js (CVE-2025-29927) where a request carrying an x-middleware-subrequest header skips the middleware entirely.
Why it matters: Sites that check the login in middleware then serve protected pages to anyone who adds the header.
- 7
Keys in page source
FreeReads your page and its JavaScript files for API keys, tokens and public source maps that every visitor can download.
Source map: A file that maps your minified JavaScript back to the original source code, comments and file names.
Why it matters: Served publicly, it hands anyone your full front-end code, which makes finding bugs and hidden endpoints much easier.
- 8
File access protection
FreePrevents attackers from reaching files outside your website folder.
- 9
Outdated JS libraries
FreeFinds old JavaScript libraries on your pages that have known security holes.
- 10
Open directories
FreeChecks that folders on your server are not publicly browsable.
- 11
PHP version
FreeChecks the PHP version your server announces is still supported and patched, including the PHP2Shell fix.
- 12
Certificate protection
ProControls which companies are allowed to issue security certificates for your domain.
- 13
Security contact info
ProA standard file that tells security researchers how to report problems to you.
- 14
Open databases
ProChecks whether the Firebase or Supabase database your site talks to can be read by anyone using the public key in your own JavaScript.
- 15
Redirect abuse
ProPrevents attackers from using your links to send visitors to scam websites.
- 16
Cross-site data rules
ProControls which other websites are allowed to read data from your site.
- 17
Information leaks
ProChecks your site is not revealing software versions or errors that help attackers.
- 18
Click-hijacking protection
ProStops attackers from tricking your visitors into clicking hidden buttons.
- 19
Allowed request types
ProMakes sure the server only allows safe kinds of requests.
- 20
Leaked keys & passwords
ProScans the code your site sends to browsers for accidentally exposed passwords or API keys.
- 21
Insecure content
ProFinds insecure (http) images or scripts loaded on an otherwise secure page.
- 22
Cookie safety
ProChecks the cookies your site stores are configured so they cannot be easily stolen.
- 23
Malicious script injection
ProTests whether attackers can inject harmful scripts that run in your visitors’ browsers.
- 24
Database injection
ProTests whether attackers can trick your database into leaking or changing data.
- 25
Form request forgery
ProChecks your forms can’t be tricked into acting on a logged-in user’s behalf.
- 26
Login safety
ProChecks your login page is served securely and resists automated guessing.
- 27
Password strength rules
ProChecks whether your signup form encourages strong, hard-to-guess passwords.
- 28
Subdomain takeover risk
ProChecks DNS for dangling subdomains that attackers could claim.
- 29
CMS & known misconfigs
ProDetects WordPress/Drupal/etc. and common exposed admin or debug endpoints.
- 30
Public API docs
ProLooks for Swagger/OpenAPI/GraphQL docs left open on the internet.
- 31
Malware & defacement
ProScans pages for injected miners, spam, and other compromise signatures.
- 32
Host header attacks
ProTests whether forged Host headers can poison redirects or confuse the server.
- 33
WordPress & plugin updates
ProIf your site runs WordPress, checks the core and plugin versions are current and no plugin was pulled from the WordPress directory.
- 34
Third-party script integrity
ProChecks external scripts use Subresource Integrity so a hacked CDN can’t inject code into your site.
- 35
Login tokens in browser storage
ProChecks your login tokens aren’t kept where any script (or an XSS bug) could steal them.
Cross-Site Scripting (XSS): A flaw that lets an attacker run their own JavaScript in your visitors’ browsers.
Why it matters: It can steal logins, hijack accounts, or deface your site, so it must be blocked.
Run these 35 Security checks on your site
One scan covers this list and the other categories, and the report says what to fix first.