dmosk / sitechecker
sitechecker — Methodik
Passive GET/HEAD only. Level 1 is public hygiene; level 2 probes sensitive paths after ownership proof. This is a baseline, not a penetration test.
Score starts at 100. Fail deductions: critical −30, high −12, medium −5, low −2, info 0. Warn subtracts half. Any critical finding caps the grade at D. Grades: A ≥90, B 80–89, C 65–79, D 50–64, F below 50.
| ID | Prüfung | Gruppe | Schwere | Stufe |
|---|---|---|---|---|
H1 |
HSTS is missing or too weak | Header | hoch | L1 |
H2 |
Content-Security-Policy is missing or too loose | Header | hoch | L1 |
H3 |
Clickjacking protection is missing | Header | mittel | L1 |
H4 |
MIME sniffing is not blocked | Header | mittel | L1 |
H5 |
Referrer-Policy is not set | Header | niedrig | L1 |
H6 |
Permissions-Policy is not set | Header | niedrig | L1 |
H7 |
Server software versions are exposed | Header | niedrig | L1 |
H8 |
Dangerous CORS combination | Header | hoch | L1 |
T1 |
HTTP does not redirect to HTTPS | TLS | hoch | L1 |
T2 |
HTTPS is unavailable or broken | TLS | kritisch | L1 |
T3 |
TLS version is outdated | TLS | hoch | L1 |
T4 |
Weak TLS ciphers detected | TLS | hoch | L1 |
T5 |
Mixed content on the page | TLS | mittel | L1 |
T6 |
HTTP/2 is not offered | TLS | info | L1 |
C1 |
Cookies without the Secure flag | Cookies | hoch | L1 |
C2 |
Cookies without HttpOnly | Cookies | hoch | L1 |
C3 |
Cookies without SameSite | Cookies | mittel | L1 |
C4 |
Cookie name prefixes are unused | Cookies | info | L1 |
F1 |
Git repository is publicly readable | Dateien | kritisch | L2 |
F2 |
Environment or config backups are reachable | Dateien | kritisch | L2 |
F3 |
Backup archives or SQL dumps are public | Dateien | kritisch | L2 |
F4 |
Diagnostic pages are exposed | Dateien | hoch | L2 |
F5 |
Directory listing is enabled | Dateien | mittel | L2 |
F6 |
Database admin panels look public | Dateien | mittel | L2 |
F7 |
security.txt is missing | Dateien | info | L1 |
S1 |
Public technology fingerprint | Software | info | L1 |
S2 |
Possibly outdated software | Software | hoch | L1 |
S3 |
Sensitive paths look exposed | Software | mittel | L1 |
S4 |
Subresource Integrity is missing | Software | niedrig | L1 |
D1 |
SPF record is missing or unsafe | DNS & Mail | mittel | L1 |
D2 |
DKIM selectors not found | DNS & Mail | info | L1 |
D3 |
DMARC is missing or too weak | DNS & Mail | mittel | L1 |
D4 |
DNSSEC status | DNS & Mail | info | L1 |
D5 |
CAA records | DNS & Mail | info | L1 |
D6 |
Internal or risky DNS targets | DNS & Mail | hoch | L1 |