dmosk / sitechecker

← بازگشت به بررسی

sitechecker — روش‌شناسی

Passive GET/HEAD only. Level 1 is public hygiene; level 2 probes sensitive paths after ownership proof. This is a baseline, not a penetration test.

Score starts at 100. Fail deductions: critical −30, high −12, medium −5, low −2, info 0. Warn subtracts half. Any critical finding caps the grade at D. Grades: A ≥90, B 80–89, C 65–79, D 50–64, F below 50.

ID بررسی گروه شدت سطح
H1 HSTS is missing or too weak هدرها بالا L1
H2 Content-Security-Policy is missing or too loose هدرها بالا L1
H3 Clickjacking protection is missing هدرها متوسط L1
H4 MIME sniffing is not blocked هدرها متوسط L1
H5 Referrer-Policy is not set هدرها پایین L1
H6 Permissions-Policy is not set هدرها پایین L1
H7 Server software versions are exposed هدرها پایین L1
H8 Dangerous CORS combination هدرها بالا L1
T1 HTTP does not redirect to HTTPS TLS بالا L1
T2 HTTPS is unavailable or broken TLS بحرانی L1
T3 TLS version is outdated TLS بالا L1
T4 Weak TLS ciphers detected TLS بالا L1
T5 Mixed content on the page TLS متوسط L1
T6 HTTP/2 is not offered TLS اطلاع L1
C1 Cookies without the Secure flag کوکی‌ها بالا L1
C2 Cookies without HttpOnly کوکی‌ها بالا L1
C3 Cookies without SameSite کوکی‌ها متوسط L1
C4 Cookie name prefixes are unused کوکی‌ها اطلاع L1
F1 Git repository is publicly readable فایل‌ها بحرانی L2
F2 Environment or config backups are reachable فایل‌ها بحرانی L2
F3 Backup archives or SQL dumps are public فایل‌ها بحرانی L2
F4 Diagnostic pages are exposed فایل‌ها بالا L2
F5 Directory listing is enabled فایل‌ها متوسط L2
F6 Database admin panels look public فایل‌ها متوسط L2
F7 security.txt is missing فایل‌ها اطلاع L1
S1 Public technology fingerprint نرم‌افزار اطلاع L1
S2 Possibly outdated software نرم‌افزار بالا L1
S3 Sensitive paths look exposed نرم‌افزار متوسط L1
S4 Subresource Integrity is missing نرم‌افزار پایین L1
D1 SPF record is missing or unsafe DNS و ایمیل متوسط L1
D2 DKIM selectors not found DNS و ایمیل اطلاع L1
D3 DMARC is missing or too weak DNS و ایمیل متوسط L1
D4 DNSSEC status DNS و ایمیل اطلاع L1
D5 CAA records DNS و ایمیل اطلاع L1
D6 Internal or risky DNS targets DNS و ایمیل بالا L1