Home / Check catalog / 6. Schema, Local, Trust, Deep Audit / 6.33 Security / HTTPS Integrity / Headers / CSP / Anti-Spam / Anti-Bot / AI-Trust Signal Suite

6.33 Security / HTTPS Integrity / Headers / CSP / Anti-Spam / Anti-Bot / AI-Trust Signal Suite

200 checks in Schema, Local, Trust, Deep Audit. Automated Its subsection has a live automated checker in the engine.

HTTPS Integrity, TLS, HSTS & Certificate Validation

ID	Check	Passes when	Weight	Runs
6.33.01	Validate HTTPS enforced globally	Enforced	Critical	Deterministic
6.33.02	Validate HTTP → HTTPS redirect permanent (301)	Correct	Critical	Deterministic
6.33.03	Validate TLS version ≥ TLS 1.2	Modern	Critical	Deterministic
6.33.04	Validate certificate valid, non-expired, non-self-signed	Valid	Critical	Deterministic
6.33.05	Validate certificate chain complete	Complete	Heavy	Deterministic
6.33.06	Validate no mixed content requests	None	Heavy	Deterministic
6.33.07	Validate HSTS header active	Active	Heavy	Deterministic
6.33.08	Validate HSTS preload readiness	Ready	Heavy	Deterministic
6.33.09	Validate correct OCSP stapling	Correct	Medium	Deterministic
6.33.10	Validate TLS cipher suites modern	Modern	Medium	Deterministic

Security Headers — CSP, X-Frame, Xss, Mime, Referrer

ID	Check	Passes when	Weight	Runs
6.33.11	Validate Content-Security-Policy present	Present	Critical	Deterministic
6.33.12	Validate CSP blocks inline script unless hashed	Strong	Critical	Deterministic
6.33.13	Validate X-Frame-Options = DENY or SAMEORIGIN	Correct	Critical	Deterministic
6.33.14	Validate X-XSS-Protection enabled (legacy but important)	Enabled	Heavy	Deterministic
6.33.15	Validate X-Content-Type-Options = nosniff	Correct	Heavy	Deterministic
6.33.16	Validate Referrer-Policy not exposing sensitive URLs	Safe	Heavy	Deterministic
6.33.17	Validate Permissions-Policy correctly configured	Configured	Medium	Deterministic
6.33.18	Validate Cross-Origin-Opener-Policy configured	Correct	Medium	Deterministic
6.33.19	Validate no deprecated headers	Clean	Medium	Deterministic
6.33.20	Validate security headers consistent across all pages	Consistent	Medium	Deterministic

Cookies — Secure, Httponly, Samesite, Lifetime

ID	Check	Passes when	Weight	Runs
6.33.21	Validate Secure flag on cookies	Secure	Critical	Deterministic
6.33.22	Validate HttpOnly flag enabled	Enabled	Critical	Deterministic
6.33.23	Validate SameSite=strict or lax	Correct	Heavy	Deterministic
6.33.24	Validate no plaintext cookies	None	Heavy	Deterministic
6.33.25	Validate cookie expiration reasonable	Safe	Heavy	Deterministic
6.33.26	Validate cookies not set on HTTP pages	Clean	Medium	Deterministic
6.33.27	Validate no sensitive info stored in cookies	Clean	Medium	Deterministic
6.33.28	Validate cookie path & domain secure	Correct	Medium	Deterministic
6.33.29	Validate cookie prefixes (__Secure-, __Host-) used correctly	Correct	Medium	Deterministic
6.33.30	Validate cookie lifecycle documented	Documented	Medium	Deterministic

CORS — Access Control & Origin Safety

ID	Check	Passes when	Weight	Runs
6.33.31	Validate Access-Control-Allow-Origin not set to "*" unnecessarily	Safe	Heavy	Deterministic
6.33.32	Validate CORS rules scoped correctly	Scoped	Heavy	Deterministic
6.33.33	Validate preflight requests allowed only where needed	Minimal	Heavy	Deterministic
6.33.34	Validate allowed headers limited to necessary ones	Limited	Medium	Deterministic
6.33.35	Validate allowed methods correct	Correct	Medium	Deterministic
6.33.36	Validate CORS errors absent from logs	Clean	Medium	Deterministic
6.33.37	Validate no CORS leaks exposing data	Clean	Medium	Deterministic
6.33.38	Validate Access-Control-Allow-Credentials used correctly	Correct	Medium	Deterministic
6.33.39	Validate origin reflection not vulnerable	Safe	Medium	Deterministic
6.33.40	Validate CORS consistency across endpoints	Consistent	Medium	Deterministic

Sri — Subresource Integrity, Script Safety & Supply Chain

ID	Check	Passes when	Weight	Runs
6.33.41	Validate SRI hashes used for CDN JS/CSS	Present	Critical	Deterministic
6.33.42	Validate integrity attributes correct	Correct	Critical	Deterministic
6.33.43	Validate third‑party scripts audited	Audited	Heavy	Deterministic
6.33.44	Validate dependency versions locked (package-lock)	Locked	Heavy	Deterministic
6.33.45	Validate no outdated vulnerable dependencies	Clean	Heavy	Deterministic
6.33.46	Validate no inline scripts without nonce or hash	Safe	Medium	Deterministic
6.33.47	Validate no external scripts loaded over HTTP	Clean	Medium	Deterministic
6.33.48	Validate package manifests validated	Validated	Medium	Deterministic
6.33.49	Validate software supply chain vulnerability scan	Completed	Medium	Deterministic
6.33.50	Compute partial Security score for Chunk 1	Complete	Medium	Deterministic

Authentication — Passwords, Login Flows, Session Security

ID	Check	Passes when	Weight	Runs
6.33.51	Validate password hashing uses bcrypt/argon2/scrypt	Strong	Critical	Deterministic
6.33.52	Validate no plaintext passwords stored	None	Critical	Deterministic
6.33.53	Validate login rate limiting enabled	Enabled	Critical	Deterministic
6.33.54	Validate MFA/2FA supported	Supported	Heavy	Deterministic
6.33.55	Validate password reset token expiration <15 min	Secure	Heavy	Deterministic
6.33.56	Validate password reset links single-use	Single-use	Heavy	Deterministic
6.33.57	Validate login form protected against brute force	Protected	Medium	Deterministic
6.33.58	Validate account lockout after failed attempts	Active	Medium	Deterministic
6.33.59	Validate session tokens not stored in localStorage	Avoided	Medium	Deterministic
6.33.60	Validate login endpoints behind rate limiter	Correct	Medium	Deterministic

Session Management — Jwt, Cookies, Token Rotation

ID	Check	Passes when	Weight	Runs
6.33.61	Validate JWT signed with strong algorithm (RS256/ES256)	Strong	Critical	Deterministic
6.33.62	Validate JWT expiration short (<15 min access token)	Short	Critical	Deterministic
6.33.63	Validate refresh token rotation	Rotated	Heavy	Deterministic
6.33.64	Validate Secure + HttpOnly flags on session cookies	Set	Heavy	Deterministic
6.33.65	Validate no sensitive info stored in JWT payload	Clean	Heavy	Deterministic
6.33.66	Validate session invalidation on logout	Functional	Medium	Deterministic
6.33.67	Validate idle session timeout < 30 min	<30m	Medium	Deterministic
6.33.68	Validate session renewal extends expiration safely	Safe	Medium	Deterministic
6.33.69	Validate session cookies scoped to correct path/domain	Correct	Medium	Deterministic
6.33.70	Validate JWT signature verification always performed	Verified	Medium	Deterministic

Admin Panel Security — Access, Lockdown, Hardening

ID	Check	Passes when	Weight	Runs
6.33.71	Validate /admin/ route protected	Protected	Critical	Deterministic
6.33.72	Validate admin login behind IP filtering or MFA	Strong	Critical	Deterministic
6.33.73	Validate no admin pages indexable	Noindex	Heavy	Deterministic
6.33.74	Validate admin panel uses HTTPS only	Enforced	Heavy	Deterministic
6.33.75	Validate admin actions logged (audit log)	Logged	Heavy	Deterministic
6.33.76	Validate admin panel CSRF protection	Active	Medium	Deterministic
6.33.77	Validate admin file uploads scanned	Safe	Medium	Deterministic
6.33.78	Validate admin sessions short-lived	Short	Medium	Deterministic
6.33.79	Validate admin forms escape user input	Escaped	Medium	Deterministic
6.33.80	Validate admin routes not guessable (optional)	Obscured	Medium	Deterministic

Firewall, Ddos, Rate Limiting, Bot Control

ID	Check	Passes when	Weight	Runs
6.33.81	Validate WAF enabled (Cloudflare, AWS WAF, etc.)	Enabled	Critical	Deterministic
6.33.82	Validate bot protection does not block AI crawlers	AI‑Friendly	Critical	Deterministic
6.33.83	Validate rate limiting for sensitive endpoints	Active	Heavy	Deterministic
6.33.84	Validate DDOS protection configured	Configured	Heavy	Deterministic
6.33.85	Validate firewall blocks known malicious IP ranges	Blocked	Heavy	Deterministic
6.33.86	Validate no CAPTCHA walls blocking accessibility	Accessible	Medium	Deterministic
6.33.87	Validate anomaly detection logs functional	Functional	Medium	Deterministic
6.33.88	Validate firewall rules not overly strict	Balanced	Medium	Deterministic
6.33.89	Validate bot scoring thresholds correct	Correct	Medium	Deterministic
6.33.90	Validate no shadow firewalls causing random blocking	None	Medium	Deterministic

Spam Protection — Forms, Emails, Scripts, Injection

ID	Check	Passes when	Weight	Runs
6.33.91	Validate forms protected from spam without blocking real users	Balanced	Heavy	Deterministic
6.33.92	Validate email forms sanitized	Sanitized	Heavy	Deterministic
6.33.93	Validate backend rejects HTML injection	Clean	Heavy	Deterministic
6.33.94	Validate honeypot fields effective	Effective	Medium	Deterministic
6.33.95	Validate bad word filters accurate	Accurate	Medium	Deterministic
6.33.96	Validate no open mail relays	Closed	Medium	Deterministic
6.33.97	Validate email throttling in place	Active	Medium	Deterministic
6.33.98	Validate form submission endpoints behind rate limiting	Protected	Medium	Deterministic
6.33.99	Validate form validation server-side	Active	Medium	Deterministic
6.33.100	Compute partial Security score for Chunk 2	Complete	Medium	Deterministic

Email Authentication — Spf, Dkim, Dmarc, Bimi

ID	Check	Passes when	Weight	Runs
6.33.101	Validate SPF record present & correct	Valid	Critical	Deterministic
6.33.102	Validate DKIM signing active	Active	Critical	Deterministic
6.33.103	Validate DMARC policy set (none/quarantine/reject)	Present	Critical	Deterministic
6.33.104	Validate DMARC alignment (DKIM/SPF) correct	Correct	Heavy	Deterministic
6.33.105	Validate BIMI record present (if applicable)	Present	Heavy	Deterministic
6.33.106	Validate email reverse DNS configured	Correct	Medium	Deterministic
6.33.107	Validate no open forwarding loops	None	Medium	Deterministic
6.33.108	Validate SMTP banner does not leak sensitive info	Clean	Medium	Deterministic
6.33.109	Validate outbound IP not on spam blacklists	Clean	Medium	Deterministic
6.33.110	Validate secure SMTP ports used (587, 465)	Secure	Medium	Deterministic

Csrf, Xss, Sqli, Ssrf & Input Validation

ID	Check	Passes when	Weight	Runs
6.33.111	Validate CSRF tokens on all form endpoints	Present	Critical	Deterministic
6.33.112	Validate XSS protection via sanitization & escaping	Safe	Critical	Deterministic
6.33.113	Validate SQL queries parameterized	Parameterized	Critical	Deterministic
6.33.114	Validate SSRF protections on external fetch endpoints	Protected	Heavy	Deterministic
6.33.115	Validate no eval() or unsafe function execution	None	Heavy	Deterministic
6.33.116	Validate upload sanitization (file type, size, MIME)	Sanitized	Heavy	Deterministic
6.33.117	Validate all user input validated server-side	Validated	Medium	Deterministic
6.33.118	Validate no HTML injection vulnerabilities	Clean	Medium	Deterministic
6.33.119	Validate search fields sanitized	Sanitized	Medium	Deterministic
6.33.120	Validate redirect parameters validated (open redirect check)	Protected	Medium	Deterministic

Supply Chain Security — Dependencies, Packages, Versioning

ID	Check	Passes when	Weight	Runs
6.33.121	Validate dependency vulnerability scan (Snyk/GitHub)	Completed	Heavy	Deterministic
6.33.122	Validate no critical CVEs in dependencies	Clean	Heavy	Deterministic
6.33.123	Validate pinned versions in package-lock	Pinned	Heavy	Deterministic
6.33.124	Validate build pipeline verifies integrity	Verified	Heavy	Deterministic
6.33.125	Validate no abandoned libraries	None	Medium	Deterministic
6.33.126	Validate node_modules not exposed publicly	Not exposed	Medium	Deterministic
6.33.127	Validate supply chain trust (no suspicious packages)	Safe	Medium	Deterministic
6.33.128	Validate external script providers trusted	Trusted	Medium	Deterministic
6.33.129	Validate dependencies minimal and necessary	Minimal	Medium	Deterministic
6.33.130	Validate build artifacts clean & reproducible	Reproducible	Medium	Deterministic

AI-Trust Signals — Transparency, Provenance, Consistency

ID	Check	Passes when	Weight	Runs
6.33.131	Validate provenance metadata available (authors/org details)	Present	Heavy	Deterministic
6.33.132	Validate organizational identity consistent across site	Consistent	Heavy	Deterministic
6.33.133	Validate AI can verify source integrity via headers/meta	Verifiable	Heavy	Deterministic
6.33.134	Validate contact & ownership signals machine-readable	Clear	Medium	Deterministic
6.33.135	Validate absence of deceptive cloaking	Clean	Medium	Deterministic
6.33.136	Validate content integrity (no contradictory versions)	Consistent	Medium	Deterministic
6.33.137	Validate site identity signals match social/corp records	Matching	Medium	Deterministic
6.33.138	Validate AI cannot be misled by hidden redirects	Safe	Medium	Deterministic
6.33.139	Validate predictable URL identity for entity mapping	Predictable	Medium	Deterministic
6.33.140	Validate all trust signals consistent across languages	Consistent	Medium	Deterministic

Server Hardening — Filesystem, Access Control, Logging

ID	Check	Passes when	Weight	Runs
6.33.141	Validate no .git exposed publicly	Protected	Heavy	Deterministic
6.33.142	Validate upload directories not executable	Safe	Heavy	Deterministic
6.33.143	Validate .env not exposed	Protected	Heavy	Deterministic
6.33.144	Validate server logs rotate properly	Rotated	Medium	Deterministic
6.33.145	Validate file permissions 600/640/750 as appropriate	Correct	Medium	Deterministic
6.33.146	Validate root login disabled (SSH)	Disabled	Medium	Deterministic
6.33.147	Validate SSH keys used instead of passwords	Keys	Medium	Deterministic
6.33.148	Validate firewall blocks all unused ports	Blocked	Medium	Deterministic
6.33.149	Validate audit logs capture security events	Captured	Medium	Deterministic
6.33.150	Compute partial Security score for Chunk 3	Complete	Critical	Deterministic

Logging, Monitoring & Auditability — Security Observability Suite

ID	Check	Passes when	Weight	Runs
6.33.151	Validate security logs centralized (SIEM)	Centralized	Heavy	Deterministic
6.33.152	Validate intrusion detection enabled (IDS)	Enabled	Heavy	Deterministic
6.33.153	Validate intrusion prevention active (IPS)	Active	Heavy	Deterministic
6.33.154	Validate admin action logs immutable	Immutable	Medium	Deterministic
6.33.155	Validate system logs include timestamps & IPs	Complete	Medium	Deterministic
6.33.156	Validate logs stored securely (no plaintext PII)	Sanitized	Medium	Deterministic
6.33.157	Validate alerting triggers on anomalies	Triggered	Medium	Deterministic
6.33.158	Validate log retention period appropriate	Appropriate	Medium	Deterministic
6.33.159	Validate no log flooding from bots	Clean	Medium	Deterministic
6.33.160	Validate log storage encrypted at rest	Encrypted	Medium	Deterministic

Backup, Recovery & Business Continuity — Security Resilience

ID	Check	Passes when	Weight	Runs
6.33.161	Validate automatic backups enabled	Enabled	Critical	Deterministic
6.33.162	Validate backup restoration tested	Tested	Critical	Deterministic
6.33.163	Validate backup frequency appropriate (daily/hourly)	Appropriate	Heavy	Deterministic
6.33.164	Validate backups encrypted in transit & at rest	Encrypted	Heavy	Deterministic
6.33.165	Validate off‑site backup redundancy	Redundant	Heavy	Deterministic
6.33.166	Validate disaster recovery plan documented	Documented	Medium	Deterministic
6.33.167	Validate RTO/RPO targets reasonable	Reasonable	Medium	Deterministic
6.33.168	Validate snapshots functioning (VMs, DBs, FS)	Functional	Medium	Deterministic
6.33.169	Validate backup storage access restricted	Restricted	Medium	Deterministic
6.33.170	Validate backup process does not expose credentials	Safe	Medium	Deterministic

Server Configuration — Hardening, Process Isolation, Network Safety

ID	Check	Passes when	Weight	Runs
6.33.171	Validate PHP/Node/Python versions modern & patched	Updated	Heavy	Deterministic
6.33.172	Validate process isolation (Docker/VM) active	Isolated	Heavy	Deterministic
6.33.173	Validate cron jobs safe & non‑exploitable	Safe	Heavy	Deterministic
6.33.174	Validate default server pages removed	Removed	Medium	Deterministic
6.33.175	Validate server banners do not reveal versions	Hidden	Medium	Deterministic
6.33.176	Validate directory indexing disabled	Disabled	Medium	Deterministic
6.33.177	Validate no world‑writable directories	None	Medium	Deterministic
6.33.178	Validate API keys stored properly (env vars, vaults)	Secure	Medium	Deterministic
6.33.179	Validate SSH hardened (protocol 2, safe ciphers)	Hardened	Medium	Deterministic
6.33.180	Validate background workers not exposing endpoints	Safe	Medium	Deterministic

AI-Security & Trust Identity — Machine-Verifyable Safety

ID	Check	Passes when	Weight	Runs
6.33.181	Validate AI receives deterministic identity signals	Deterministic	Critical	Deterministic
6.33.182	Validate no forged brand identities across URLs	Clean	Heavy	Deterministic
6.33.183	Validate AI can map organization → domain consistently	Consistent	Heavy	Deterministic
6.33.184	Validate machine‑readable ownership metadata available	Present	Medium	Deterministic
6.33.185	Validate transparency disclosures visible	Visible	Medium	Deterministic
6.33.186	Validate machine‑readable risk disclosures present	Present	Medium	Deterministic
6.33.187	Validate no deceptive or contradictory security pages	Clean	Medium	Deterministic
6.33.188	Validate snapshot consistency for AI (canonical identity)	Consistent	Medium	Deterministic
6.33.189	Validate AI receives same data as humans (no cloaking)	True	Medium	Deterministic
6.33.190	Validate trust badges & compliance claims verifiable	Verifiable	Medium	Deterministic

Final Security Validations — Holistic System Check

ID	Check	Passes when	Weight	Runs
6.33.191	Validate entire site free of critical vulnerabilities	Clean	Critical	Deterministic
6.33.192	Validate all sensitive endpoints hardened	Hardened	Critical	Deterministic
6.33.193	Validate overall risk score < 10%	Low	Heavy	Deterministic
6.33.194	Validate no security regressions after simulated attack	None	Heavy	Deterministic
6.33.195	Validate dependency graph safe after updates	Safe	Heavy	Deterministic
6.33.196	Validate security posture consistent over 30 days	Consistent	Medium	Deterministic
6.33.197	Validate all admin routes, tokens, and cookies validated	Validated	Medium	Deterministic
6.33.198	Validate rate limits not bypassed	Enforced	Medium	Deterministic
6.33.199	Validate no false positives in bot/AI detection	Balanced	Medium	Deterministic
6.33.200	Compute full SECURITY composite score	Finalized	Critical	Deterministic

← 6.32 Performance / Core Web Vitals / Caching / CDN / Rendering Cost / AI-Speed Signal Suite6.34 Content Quality / E-E-A-T / Thematic Authority / NLP-Semantics / AI-Readability & Favorability Signal Suite →

Run these checks on your site

A Deep Audit scores every check here that applies to your page, then an AI pass of up to 150 checks. Included on Pro and Ultra, or $9 for one audit.

See plans

Machine-readable: catalog totals and the full catalog as JSON (IDs, section, weight, status).