Security website checks

Website security checks examine transport protection, response headers, cookie attributes and publicly exposed resources. A missing header is evidence of a missing browser defence, not proof of an exploitable vulnerability. A passing public scan cannot establish how passwords are stored, whether permissions are enforced or whether private records are isolated.

Roll out restrictive policies in stages. Test Content Security Policy in report-only mode before enforcement, check embedded content before changing framing rules and confirm HTTPS coverage before extending HSTS. Inspect redirects and error responses as well as the homepage. Record the policy, tested journeys and reasons for accepted exceptions.

The check pages below describe the exact observable condition, why it matters, practical fixes and the limits of the detector. Open the affected URL and inspect its evidence before making a change. After correction, repeat the scan and verify the result in a browser. The related guide connects these individual checks into a review workflow. Keep deliberate exceptions documented so that a passing automated result is never mistaken for a complete manual assessment.