What we check

Every check we run, what it looks for, and how serious it usually is. Severities shown are the automated starting point; Claude adjusts them to your site.

HTTPS and certificates

Site served over plain HTTP high: Everything visitors send, including passwords, travels unencrypted.
HTTP doesn't redirect to HTTPS medium: Visitors who type your domain without https:// stay on the insecure version.
Untrusted, expired or soon-to-expire certificate critical high medium: Browsers show a full-page warning for expired or untrusted certificates. We warn you 14 days before expiry.
Outdated TLS version medium: TLS 1.0 and 1.1 have known weaknesses and are disabled by modern browsers.

Security headers

Missing Strict-Transport-Security (HSTS) medium: Without it, a visitor's first request can be downgraded to HTTP. We also flag a max-age under six months.
Missing or weak Content-Security-Policy medium: CSP is the main browser defence against cross-site scripting. Policies that allow 'unsafe-inline', 'unsafe-eval' or wildcard script sources are flagged as weak.
Pages can be framed medium: No X-Frame-Options or CSP frame-ancestors, so another site can embed yours and trick visitors into clicking (clickjacking).
Missing nosniff, Referrer-Policy or Permissions-Policy low info: Smaller hardening headers that close off content-type confusion, leaky referrers and unused browser features.
Server version disclosed low: Headers like Server: Apache/2.4.29 or X-Powered-By tell attackers exactly which known vulnerabilities to try.

Cookies

Session cookie missing Secure or HttpOnly medium: Without Secure the cookie can leak over HTTP; without HttpOnly any injected script can steal it. Cookies whose names look like sessions or auth tokens are rated higher.
Missing SameSite low: SameSite limits when the browser sends the cookie on cross-site requests, which blunts CSRF.

Forms and content

Password form on an HTTP page, or posting to HTTP high: Credentials are sent unencrypted.
Password form submitted with GET medium: The password ends up in the URL, and from there in logs, history and analytics.
POST form without a visible CSRF token low: A heuristic: the server may protect the form another way, so Claude usually marks this for a manual check.
Mixed content high low: An HTTPS page loading scripts or styles over HTTP (high) or images and media over HTTP (low).
Directory listing enabled medium: An "Index of /" page that lists files on the server.
Revealing HTML comments or generator tags low info: Comments mentioning passwords, keys, TODOs or internal details, and meta tags announcing your CMS version.

Compromised and outdated packages

We identify npm packages from CDN URLs such as unpkg, jsDelivr and cdnjs, version banners in downloaded and inline scripts, and exact framework metadata. Supported Drupal core versions are identified from generator metadata. We query OSV for the exact versions during each scan and retrieve advisory identifiers, CVE aliases, publication dates, source links and published fix versions.

Detection also inspects third-party scripts and styles, follows literal module imports and linked source maps, and reads exact package metadata embedded in bundles or source maps. This can identify dependencies hidden behind hashed asset names. We do not execute the site's JavaScript or treat a filename hash or an unversioned module name as an installed version.

Known-malicious package version critical: The version your site loads has been reported as hijacked or backdoored, for example in the OpenSSF malicious-packages database or a GitHub malware advisory.
Package with known vulnerabilities high medium: The detected version matches a published advisory. Fixed versions are shown when the source provides them; some issues have no published fix. Matches indicate potential exposure, not proof of exploitation.
Indicators from recent incidents critical: Domains and code patterns from recent supply-chain attacks, found anywhere in your pages or scripts. See the supply-chain watch for the current list and when it was last updated.
CDN scripts without Subresource Integrity low: Without an integrity hash, a compromised CDN could serve you different code without you noticing.

Missing versions and incomplete lookups are coverage gaps. WordPress components are listed for manual verification because comprehensive live advisory matching is not available for them here. Server-only, build and CI dependencies need a dependency scanner in your codebase.

Leaked secrets

Secret keys in page source or JavaScript critical high: Private keys, Stripe live secret keys, AWS access keys, GitHub, Slack and AI-provider tokens, and hard-coded passwords. Values are masked in the report.
Google API keys low: Often meant to be public; we remind you to restrict them by referrer and API.

Exposed files

We request each of these paths once and only report it if the response really looks like that file.

Source control and environment files critical: /.git/HEAD, /.git/config, /.env: enough to rebuild your source code or read your secrets.
Database dumps and config backups critical high: /backup.sql, /dump.sql, /wp-config.php.bak, /config.php.bak, /.htpasswd.
Diagnostic pages high medium: /phpinfo.php, /info.php, Apache /server-status, Spring Boot /actuator and /actuator/env.
Other low info: /.DS_Store, permissive /crossdomain.xml, public swagger.json / openapi.json, sensitive paths listed in robots.txt, and a missing /.well-known/security.txt.

CORS, methods and errors

CORS reflects any origin high medium: Your server echoes back whatever site asks. With credentials allowed, any website can read your users' logged-in data.
Verbose error pages medium: Stack traces and database errors from Python, Java, .NET, PHP, Node.js and common frameworks.
Risky HTTP methods advertised low: PUT, DELETE, PATCH or TRACE listed as allowed on your home page.