🛡️ Website Security Check
Audit security headers (HSTS, CSP, X-Frame-Options, etc.) and mixed content with just a URL.
📖 What this check tells you
This check inspects what a single request can reveal — response headers, cookie attributes, how TLS is used — and reports the security posture visible from outside. It cannot find application vulnerabilities. SQL injection and broken access control exist quite happily behind a perfect score here. What this covers is the layer where one line of configuration closes a door, which makes it the best return on effort you will get.
| Item | What it means | How to fix it |
|---|---|---|
HttpOnly on cookies |
With it set, document.cookie cannot read the value. Even a successful XSS cannot carry the session ID away. |
Always set it on the session cookie — session.cookie_httponly = 1 in PHP. If some value has to be readable from JavaScript, put it in a separate cookie; removing HttpOnly to make the session readable defeats the point. |
SameSite on cookies |
Controls whether the cookie rides along on requests originating from other sites. It is a structural defence against CSRF, used alongside tokens rather than instead of them. | Default to Lax, and use Strict for sensitive actions such as payments. If you set None, Secure is mandatory — without it modern browsers drop the cookie entirely, which is the usual reason an SSO or iframe embed suddenly stops working. |
| Server details exposed | Headers like Server: nginx/1.18.0 or X-Powered-By: PHP/8.1.2 tell an attacker exactly which version to look up known vulnerabilities for. |
Set server_tokens off; in nginx and expose_php = Off in PHP. This buys time; it is not a defence. Hiding the version matters far less than actually upgrading it. |
| Mixed content | An HTTPS page loading scripts or images over http://. Browsers block the scripts outright and downgrade the padlock for the images. | Rewrite the embedded URLs to https://. If a third-party service has no HTTPS at all, the real decision is whether to keep using it. During a migration, Content-Security-Policy: upgrade-insecure-requests can promote them automatically. |
A perfect score here means only that the externally visible configuration is in order. Authentication and authorisation logic, input handling, and known vulnerabilities in your dependencies all need checking separately. Starting with a dependency audit — composer audit, npm audit — is the practical next step.