dmosk / sitechecker

← 검사로 돌아가기

sitechecker — 방법론

Passive GET/HEAD only. Level 1 is public hygiene; level 2 probes sensitive paths after ownership proof. This is a baseline, not a penetration test.

Score starts at 100. Fail deductions: critical −30, high −12, medium −5, low −2, info 0. Warn subtracts half. Any critical finding caps the grade at D. Grades: A ≥90, B 80–89, C 65–79, D 50–64, F below 50.

ID 검사 그룹 심각도 레벨
H1 HSTS is missing or too weak 헤더 높음 L1
H2 Content-Security-Policy is missing or too loose 헤더 높음 L1
H3 Clickjacking protection is missing 헤더 보통 L1
H4 MIME sniffing is not blocked 헤더 보통 L1
H5 Referrer-Policy is not set 헤더 낮음 L1
H6 Permissions-Policy is not set 헤더 낮음 L1
H7 Server software versions are exposed 헤더 낮음 L1
H8 Dangerous CORS combination 헤더 높음 L1
T1 HTTP does not redirect to HTTPS TLS 높음 L1
T2 HTTPS is unavailable or broken TLS 치명적 L1
T3 TLS version is outdated TLS 높음 L1
T4 Weak TLS ciphers detected TLS 높음 L1
T5 Mixed content on the page TLS 보통 L1
T6 HTTP/2 is not offered TLS 정보 L1
C1 Cookies without the Secure flag 쿠키 높음 L1
C2 Cookies without HttpOnly 쿠키 높음 L1
C3 Cookies without SameSite 쿠키 보통 L1
C4 Cookie name prefixes are unused 쿠키 정보 L1
F1 Git repository is publicly readable 파일 치명적 L2
F2 Environment or config backups are reachable 파일 치명적 L2
F3 Backup archives or SQL dumps are public 파일 치명적 L2
F4 Diagnostic pages are exposed 파일 높음 L2
F5 Directory listing is enabled 파일 보통 L2
F6 Database admin panels look public 파일 보통 L2
F7 security.txt is missing 파일 정보 L1
S1 Public technology fingerprint 소프트웨어 정보 L1
S2 Possibly outdated software 소프트웨어 높음 L1
S3 Sensitive paths look exposed 소프트웨어 보통 L1
S4 Subresource Integrity is missing 소프트웨어 낮음 L1
D1 SPF record is missing or unsafe DNS·메일 보통 L1
D2 DKIM selectors not found DNS·메일 정보 L1
D3 DMARC is missing or too weak DNS·메일 보통 L1
D4 DNSSEC status DNS·메일 정보 L1
D5 CAA records DNS·메일 정보 L1
D6 Internal or risky DNS targets DNS·메일 높음 L1