Website Security Audit

Scan a website and get a 0-100 security score with the exact findings behind it: missing or weak HTTP security headers, SSL/TLS configuration, information the server leaks about itself, exposed configuration files, and common risky patterns. Every finding comes with a severity and a concrete fix.

One run audits one URL and returns one JSON record. No login, no setup, no agent to install on the site.

What you get

Real output, trimmed, for https://example.com:

{
  "url": "https://example.com/",
  "title": "Example Domain",
  "timestamp": "2026-08-13T14:58:14.397Z",
  "overallScore": 81.5,
  "headers": {
    "contentSecurityPolicy": { "present": false, "value": "", "hasUnsafeInline": false, "hasUnsafeEval": false, "recommendation": "Add Content-Security-Policy header" },
    "strictTransportSecurity": { "present": false, "maxAge": 0, "includeSubDomains": false, "preload": false },
    "xFrameOptions": { "present": false, "isDeny": false },
    "score": 36,
    "issues": [ "... 10 findings ..." ]
  },
  "ssl": {
    "isHttps": true,
    "certificateValid": true,
    "protocols": { "tls10": false, "tls11": false, "tls12": true, "tls13": false },
    "mixedContent": { "detected": false },
    "score": 95
  },
  "cms": { "adminAccessible": false, "score": 100, "issues": [] },
  "vulnerabilities": { "score": 100, "issues": [] },
  "exposed": {
    "serverVersion": "cloudflare",
    "robotsTxt": { "present": true, "exposesSensitivePaths": false },
    "sitemap": { "present": false, "exposesSensitivePaths": false },
    "score": 90
  },
  "allIssues": [
    {
      "severity": "medium",
      "category": "Exposed Information",
      "title": "Server Version Exposed",
      "description": "Server version is exposed in headers: cloudflare",
      "recommendation": "Hide server version information in HTTP headers to prevent attackers from targeting known vulnerabilities."
    }
  ]
}

allIssues gathers every finding of the run in one list, sorted by severity (critical, high, medium, low, info), so you can pipe it straight into a report or a ticket.

What it checks

HTTP security headers — Content-Security-Policy (including unsafe-inline and unsafe-eval directives), Strict-Transport-Security (with max-age, includeSubDomains, preload), X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, and the three Cross-Origin policies (COEP, COOP, CORP). Each header is reported present or absent, with its value and what to set.

SSL/TLS — HTTPS in use, certificate validity, mixed content on the page, and the TLS versions observed during the audit.

Exposed information — server and technology banners returned in headers, error messages that reveal the stack, robots.txt and sitemap analysed for sensitive paths, and directory listings left enabled.

CMS-side exposure — reachable admin panels (/wp-admin/, /admin), sensitive files served over HTTP (.env, .git/config, wp-config.php, config.php, configuration.php, .htaccess), WordPress REST API user enumeration, and CMS version numbers left in the page source.

Risky patterns — login pages exposed without protection, forms without CSRF tokens, unprotected API endpoints, and injection-prone patterns in the page. These are pattern checks, not exploitation attempts: nothing is ever sent to break the target.

Input

Field	Type	Default	What it does
startUrl	string	https://example.com	URL to audit
timeout	integer	30000	Page load timeout, in milliseconds (5000-120000)
checkHeaders	boolean	true	Run the security headers checks
checkSSL	boolean	true	Run the SSL/TLS checks
checkCMS	boolean	true	Run the CMS exposure checks
checkVulnerabilities	boolean	true	Run the risky pattern checks
checkExposed	boolean	true	Run the information disclosure checks
userAgent	string	Mozilla/5.0 (compatible; Security-Audit/1.0)	User agent sent to the site

Turning a section off skips its requests, which makes the run faster on large sites.

{
  "startUrl": "https://example.com",
  "timeout": 30000,
  "checkHeaders": true,
  "checkSSL": true,
  "checkCMS": true,
  "checkVulnerabilities": true,
  "checkExposed": true
}

How the score works

overallScore is a weighted average of the five section scores, each starting at 100 and losing points per finding: headers 25%, SSL/TLS 30%, CMS 15%, risky patterns 20%, exposed information 10%. A site with clean headers and a valid certificate typically lands between 85 and 100; a site missing CSP, HSTS and X-Frame-Options drops to the low 80s or below.

Limits, stated up front

• One URL per run. The Actor audits the page you give it, not the whole site. To cover several pages, run it once per URL.
• No vulnerability database. Findings come from what the site exposes over HTTP, not from CVE, WPScan or any advisory feed. A plugin with a known CVE will not be flagged as such.
• No exploitation. Nothing is injected, brute-forced or logged into. This is an exposure audit, not a penetration test, and it does not replace one.
• The cms.cms label is a best-effort guess from page signatures and can be wrong on sites that mix technologies. The CMS checks themselves (admin panel, sensitive files, REST API, version disclosure) run regardless of the label.
• TLS versions are observed, not probed. When they cannot be confirmed, the Actor says so in an info finding rather than guessing.
• Pages behind a login or a strict bot protection cannot be audited.

Good uses

Pre-launch checks before a site goes live, a recurring security posture check on the sites you maintain, a quick exposure report for a client or a prospect, and scoring a batch of domains by running the Actor once per URL from your own script.

Support

Found a wrong result or a site that fails? Open an issue on the Actor page with the URL and the run ID — that is the fastest way to get it fixed.