dmosk / sitechecker
sitechecker — metodologia
Passive GET/HEAD only. Level 1 is public hygiene; level 2 probes sensitive paths after ownership proof. This is a baseline, not a penetration test.
Score starts at 100. Fail deductions: critical −30, high −12, medium −5, low −2, info 0. Warn subtracts half. Any critical finding caps the grade at D. Grades: A ≥90, B 80–89, C 65–79, D 50–64, F below 50.
| ID | Controllo | Gruppo | Gravità | Livello |
|---|---|---|---|---|
H1 |
HSTS is missing or too weak | Intestazioni | alta | L1 |
H2 |
Content-Security-Policy is missing or too loose | Intestazioni | alta | L1 |
H3 |
Clickjacking protection is missing | Intestazioni | media | L1 |
H4 |
MIME sniffing is not blocked | Intestazioni | media | L1 |
H5 |
Referrer-Policy is not set | Intestazioni | bassa | L1 |
H6 |
Permissions-Policy is not set | Intestazioni | bassa | L1 |
H7 |
Server software versions are exposed | Intestazioni | bassa | L1 |
H8 |
Dangerous CORS combination | Intestazioni | alta | L1 |
T1 |
HTTP does not redirect to HTTPS | TLS | alta | L1 |
T2 |
HTTPS is unavailable or broken | TLS | critica | L1 |
T3 |
TLS version is outdated | TLS | alta | L1 |
T4 |
Weak TLS ciphers detected | TLS | alta | L1 |
T5 |
Mixed content on the page | TLS | media | L1 |
T6 |
HTTP/2 is not offered | TLS | info | L1 |
C1 |
Cookies without the Secure flag | Cookie | alta | L1 |
C2 |
Cookies without HttpOnly | Cookie | alta | L1 |
C3 |
Cookies without SameSite | Cookie | media | L1 |
C4 |
Cookie name prefixes are unused | Cookie | info | L1 |
F1 |
Git repository is publicly readable | File | critica | L2 |
F2 |
Environment or config backups are reachable | File | critica | L2 |
F3 |
Backup archives or SQL dumps are public | File | critica | L2 |
F4 |
Diagnostic pages are exposed | File | alta | L2 |
F5 |
Directory listing is enabled | File | media | L2 |
F6 |
Database admin panels look public | File | media | L2 |
F7 |
security.txt is missing | File | info | L1 |
S1 |
Public technology fingerprint | Software | info | L1 |
S2 |
Possibly outdated software | Software | alta | L1 |
S3 |
Sensitive paths look exposed | Software | media | L1 |
S4 |
Subresource Integrity is missing | Software | bassa | L1 |
D1 |
SPF record is missing or unsafe | DNS e posta | media | L1 |
D2 |
DKIM selectors not found | DNS e posta | info | L1 |
D3 |
DMARC is missing or too weak | DNS e posta | media | L1 |
D4 |
DNSSEC status | DNS e posta | info | L1 |
D5 |
CAA records | DNS e posta | info | L1 |
D6 |
Internal or risky DNS targets | DNS e posta | alta | L1 |