dmosk / sitechecker

sitechecker — 方法论

Passive GET/HEAD only. Level 1 is public hygiene; level 2 probes sensitive paths after ownership proof. This is a baseline, not a penetration test.

Score starts at 100. Fail deductions: critical −30, high −12, medium −5, low −2, info 0. Warn subtracts half. Any critical finding caps the grade at D. Grades: A ≥90, B 80–89, C 65–79, D 50–64, F below 50.

ID	检查项	分组	严重性	级别
`H1`	HSTS is missing or too weak	响应头	高	L1
`H2`	Content-Security-Policy is missing or too loose	响应头	高	L1
`H3`	Clickjacking protection is missing	响应头	中	L1
`H4`	MIME sniffing is not blocked	响应头	中	L1
`H5`	Referrer-Policy is not set	响应头	低	L1
`H6`	Permissions-Policy is not set	响应头	低	L1
`H7`	Server software versions are exposed	响应头	低	L1
`H8`	Dangerous CORS combination	响应头	高	L1
`T1`	HTTP does not redirect to HTTPS	TLS	高	L1
`T2`	HTTPS is unavailable or broken	TLS	严重	L1
`T3`	TLS version is outdated	TLS	高	L1
`T4`	Weak TLS ciphers detected	TLS	高	L1
`T5`	Mixed content on the page	TLS	中	L1
`T6`	HTTP/2 is not offered	TLS	信息	L1
`C1`	Cookies without the Secure flag	Cookie	高	L1
`C2`	Cookies without HttpOnly	Cookie	高	L1
`C3`	Cookies without SameSite	Cookie	中	L1
`C4`	Cookie name prefixes are unused	Cookie	信息	L1
`F1`	Git repository is publicly readable	文件	严重	L2
`F2`	Environment or config backups are reachable	文件	严重	L2
`F3`	Backup archives or SQL dumps are public	文件	严重	L2
`F4`	Diagnostic pages are exposed	文件	高	L2
`F5`	Directory listing is enabled	文件	中	L2
`F6`	Database admin panels look public	文件	中	L2
`F7`	security.txt is missing	文件	信息	L1
`S1`	Public technology fingerprint	软件	信息	L1
`S2`	Possibly outdated software	软件	高	L1
`S3`	Sensitive paths look exposed	软件	中	L1
`S4`	Subresource Integrity is missing	软件	低	L1
`D1`	SPF record is missing or unsafe	DNS 与邮件	中	L1
`D2`	DKIM selectors not found	DNS 与邮件	信息	L1
`D3`	DMARC is missing or too weak	DNS 与邮件	中	L1
`D4`	DNSSEC status	DNS 与邮件	信息	L1
`D5`	CAA records	DNS 与邮件	信息	L1
`D6`	Internal or risky DNS targets	DNS 与邮件	高	L1