dmosk / sitechecker
sitechecker — methodology
Passive GET/HEAD only. Level 1 is public hygiene; level 2 probes sensitive paths after ownership proof. This is a baseline, not a penetration test.
Score starts at 100. Fail deductions: critical −30, high −12, medium −5, low −2, info 0. Warn subtracts half. Any critical finding caps the grade at D. Grades: A ≥90, B 80–89, C 65–79, D 50–64, F below 50.
| ID | Check | Group | Severity | Level |
|---|---|---|---|---|
H1 |
HSTS is missing or too weak | Headers | high | L1 |
H2 |
Content-Security-Policy is missing or too loose | Headers | high | L1 |
H3 |
Clickjacking protection is missing | Headers | medium | L1 |
H4 |
MIME sniffing is not blocked | Headers | medium | L1 |
H5 |
Referrer-Policy is not set | Headers | low | L1 |
H6 |
Permissions-Policy is not set | Headers | low | L1 |
H7 |
Server software versions are exposed | Headers | low | L1 |
H8 |
Dangerous CORS combination | Headers | high | L1 |
T1 |
HTTP does not redirect to HTTPS | TLS | high | L1 |
T2 |
HTTPS is unavailable or broken | TLS | critical | L1 |
T3 |
TLS version is outdated | TLS | high | L1 |
T4 |
Weak TLS ciphers detected | TLS | high | L1 |
T5 |
Mixed content on the page | TLS | medium | L1 |
T6 |
HTTP/2 is not offered | TLS | info | L1 |
C1 |
Cookies without the Secure flag | Cookies | high | L1 |
C2 |
Cookies without HttpOnly | Cookies | high | L1 |
C3 |
Cookies without SameSite | Cookies | medium | L1 |
C4 |
Cookie name prefixes are unused | Cookies | info | L1 |
F1 |
Git repository is publicly readable | Files | critical | L2 |
F2 |
Environment or config backups are reachable | Files | critical | L2 |
F3 |
Backup archives or SQL dumps are public | Files | critical | L2 |
F4 |
Diagnostic pages are exposed | Files | high | L2 |
F5 |
Directory listing is enabled | Files | medium | L2 |
F6 |
Database admin panels look public | Files | medium | L2 |
F7 |
security.txt is missing | Files | info | L1 |
S1 |
Public technology fingerprint | Software | info | L1 |
S2 |
Possibly outdated software | Software | high | L1 |
S3 |
Sensitive paths look exposed | Software | medium | L1 |
S4 |
Subresource Integrity is missing | Software | low | L1 |
D1 |
SPF record is missing or unsafe | DNS & mail | medium | L1 |
D2 |
DKIM selectors not found | DNS & mail | info | L1 |
D3 |
DMARC is missing or too weak | DNS & mail | medium | L1 |
D4 |
DNSSEC status | DNS & mail | info | L1 |
D5 |
CAA records | DNS & mail | info | L1 |
D6 |
Internal or risky DNS targets | DNS & mail | high | L1 |