Security Audit

Just finished building a security audit tool (and fixed the bit I forgot)

Well to be fair a member on here mentioned it and when I find your name m8 I will give you the credit…I forgot the body lol. Whoops! but now it is complete

Free Website Security Audit: 64 checks, tested against Mozilla Observatory

I built a free website security audit. It sees your site the way an attacker does, then tells you exactly how to fix what it finds.

It started as my own Mozilla Observatory alternative. I wanted to know exactly how Observatory scores, so I rebuilt its scoring in my website security audit and tuned it one change at a time, until my scores matched theirs section by section.

Then I kept going.

Free website security scan, no account: 64 checks on everything your site exposes to the internet:

• Security headers checker (22): a full CSP checker that takes your policy apart line by line (inline scripts, inline styles, eval, default-src, object-src, base-uri, form-action), HSTS and preload, frame protection, MIME sniffing, referrer policy, permissions policy, cross-origin policies (CORP, COOP, COEP, CORS), subresource integrity, plus the optional and deprecated security headers, judged correctly
• TLS (6): certificate validity, expiry and scope, protocol, cipher strength, HTTP→HTTPS redirect
• Cookies (4): Secure, HttpOnly, SameSite, caching of private pages
• Mixed content (1) and forms (3): secure form submission, CSRF tokens, upload transport
• What's inside your page and error pages (10): secret API keys, leaky comments, downloadable source maps, email addresses, third-party scripts, inline code, stack traces and debug pages, software versions, default error pages, directory listings
• Rate limiting (1)
• Server fingerprint (3): server version, X-Powered-By, HTTP TRACE
• Known vulnerabilities (1): NIST CVE lookups for any software versions it spots
• CMS detection (2): which CMS, and whether it leaks its version
• Email spoofing protection (7): SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, DANE
• DNS (2): CAA, DNSSEC
• Published files (2): robots.txt, security.txt

Run the security audit on one page or the whole domain. Fix a page, re-test that page, and see straight away whether the fix worked.

That's how I got my own page from 80 to 150 on Mozilla Observatory. I ran the audit on my security audit page on its own, fixed what it flagged, re-tested just that page, and repeated. I left the domain and server-level checks (DNS, mail, server settings) until last, to see how far page-level fixes alone could go. Getting to 150 wasn't hard once I could see exactly what to fix and check each fix straight away. That's Mozilla's score, so anyone can check it. My own website security audit now scores that page 96/100: every CSP check passed, no inline code, no failures. The only points left are domain-level extras like DNSSEC, and I need to be in a fighting mood to tackle those.

Every finding tells you what to do: the fix, plus its OWASP and CWE references, so you know exactly what to change even if you've never touched security headers before. It's scored out of 100, with real failures kept separate from warnings and optional extras, so a nice-to-have never drags you down like a real hole. Every check has a "Learn how" link, and there's an example report, a beginner tutorial and a full guide. Everything comes out as a PDF security audit report.

Also free: see who's already been knocking. The Real Traffic Audit reads your server access log in your browser (never uploaded) and separates real people from bots, AI crawlers and your own server. Add its results file to the security audit, and the report lists every failed login, password-guessing burst, address that's been in your admin area, new account, bot probing for .env files and WordPress logins, and burst of server errors. On my own 5½-month log, it listed every address that had used my admin, including VPN sessions I'd forgotten about.

And a free full-site report. The Combined Audit's free Quick Audit puts the website security audit alongside SEO, speed, schema, accessibility and GDPR checks in one PDF, under one overall score: Meta Tag Analyzer, HTML, CSS, JavaScript and JSON checkers, Accessibility, Image Optimisation, Redirect Chain, Robots & Sitemap, Hreflang, Local SEO, Page Speed, Core Web Vitals, CLS Debugger, Schema Debugger, Rich Snippets, GDPR Audit and HTTP Error Audit. There's also a free Schema Generator that builds valid JSON-LD for any page, and an "Audit this page" button you can put on your own site.

Sign in, and it stops looking and starts hitting.
Verify your domain (a DNS TXT record or a small file on your site), and the security audit tests whether your defences actually work, not just whether they're declared:

• It hammers your login to see if you actually throttle it. Mine cuts in after 11 attempts.
• It walks up to your admin and account pages to see if they slam the door on strangers.
• It checks your security headers are the same on every page, not just the homepage.
• It throws dangerous file names at your upload form (.php, .html, .svg…) to see if it actually says no. Only a harmless text file is ever sent.

When a defence proves itself, the report marks it confirmed and the score corrects itself. Signing in also adds the Site Crawler and Trust Audit to the full-site report, the Content currency check (it checks the time-sensitive claims on a page against live Google results), and a saved history of your runs. Signed-in security audits cost 149p in credits.

How this free website security audit is tested:

• Against 200 of the internet's biggest sites and CMS platforms, for real, varying scores.
• On a network of fake sites built to fail: leaked keys, debug pages, directory listings, downloadable source maps. It catches every one, and doesn't mistake code examples on a tutorial page for real errors.
• Its upload test against 16 different real-world upload behaviours: forms that redirect, refusals hidden inside a normal reply, images-only uploads, rate limits, login walls. It gives the right verdict for every one.