Home / Check catalog / 6. Schema, Local, Trust, Deep Audit / 6.59 Security, HTTPS Configuration, Headers, Auth, Bot Safety & AI-Safe Surface

6.59 Security, HTTPS Configuration, Headers, Auth, Bot Safety & AI-Safe Surface

100 checks in Schema, Local, Trust, Deep Audit. Automated Its subsection has a live automated checker in the engine.

HTTPS & TLS — Certificate, Encryption & Transport-Layer Safety

IDCheckPasses whenWeightRuns
6.59.01Validate HTTPS activeActiveCriticalDeterministic
6.59.02Validate TLS version >= 1.2>=1.2CriticalDeterministic
6.59.03Validate certificate not expiredValidCriticalDeterministic
6.59.04Validate certificate issued by trusted CATrustedCriticalDeterministic
6.59.05Validate no mixed-content errorsNoneHeavyDeterministic
6.59.06Validate strong cipher suitesStrongHeavyDeterministic
6.59.07Validate certificate chain correctCorrectMediumDeterministic
6.59.08Validate no revoked certificateNot revokedMediumDeterministic
6.59.09Validate OCSP stapling activeActiveMediumDeterministic
6.59.10Validate SNI supportedSupportedMediumDeterministic

HSTS — Strict-Transport-Security & Redirect Safety

IDCheckPasses whenWeightRuns
6.59.11Validate HSTS header presentPresentHeavyDeterministic
6.59.12Validate HSTS max-age >= 31536000>=31536000HeavyDeterministic
6.59.13Validate HSTS includesSubDomainsIncludedHeavyDeterministic
6.59.14Validate preload flag correctCorrectMediumDeterministic
6.59.15Detect missing redirect from HTTP → HTTPSRedirectedMediumDeterministic
6.59.16Detect double redirect on HTTP → HTTPSNoneMediumDeterministic
6.59.17Validate 301 redirect not 302301MediumDeterministic
6.59.18Validate canonical URLs use HTTPSHTTPSMediumDeterministic
6.59.19Detect insecure form-action URLsNoneMediumDeterministic
6.59.20Validate external assets loaded over HTTPSHTTPSMediumDeterministic

Security Headers — Xss, Clickjacking, Content Safety & Hardening

IDCheckPasses whenWeightRuns
6.59.21Validate Content-Security-Policy (CSP) presentPresentCriticalDeterministic
6.59.22Validate CSP blocks unsafe-inline (where possible)BlockedCriticalDeterministic
6.59.23Validate X-Frame-Options SAMEORIGINSAMEORIGINCriticalDeterministic
6.59.24Validate X-XSS-Protection configuredConfiguredHeavyDeterministic
6.59.25Validate X-Content-Type-Options nosniffnosniffHeavyDeterministic
6.59.26Validate Referrer-Policy strictStrictHeavyDeterministic
6.59.27Validate Permissions-Policy presentPresentMediumDeterministic
6.59.28Validate Strict-Transport-Security correctCorrectMediumDeterministic
6.59.29Detect deprecated headersNoneMediumDeterministic
6.59.30Validate caching headers do not expose sensitive dataSafeMediumDeterministic

Owasp Alignment — Vulnerability Surface, Input Safety & Sanitation

IDCheckPasses whenWeightRuns
6.59.31Validate no reflected XSS vectorsNoneHeavyDeterministic
6.59.32Validate no stored XSS vectorsNoneHeavyDeterministic
6.59.33Validate CSRF tokens present on sensitive formsPresentHeavyDeterministic
6.59.34Validate no open redirect vulnerabilitiesNoneHeavyDeterministic
6.59.35Validate parameter sanitization server-sideSanitizedMediumDeterministic
6.59.36Validate form fields sanitized client-sideSanitizedMediumDeterministic
6.59.37Detect SQL injection vectorsNoneMediumDeterministic
6.59.38Detect command injection risksNoneMediumDeterministic
6.59.39Detect directory traversal vulnerabilitiesNoneMediumDeterministic
6.59.40Validate error messages do not reveal stack tracesSafeMediumDeterministic

Server Exposed Surface — Directories, Files, Endpoints & Metadata

IDCheckPasses whenWeightRuns
6.59.41Validate no exposed .env filesNoneHeavyDeterministic
6.59.42Validate no exposed backup files (.bak, .old)NoneHeavyDeterministic
6.59.43Validate directory listing disabledDisabledHeavyDeterministic
6.59.44Validate no exposed .git directoriesNoneMediumDeterministic
6.59.45Detect exposed log filesNoneMediumDeterministic
6.59.46Validate server tokens minimizedMinimalMediumDeterministic
6.59.47Validate .well-known structured correctlyCorrectMediumDeterministic
6.59.48Detect exposed API documentation unintentionally publicNoneMediumDeterministic
6.59.49Validate no sensitive PDF/CSV files indexedNoneMediumDeterministic
6.59.50Validate no admin URLs publicly exposedNoneMediumDeterministic

Authentication Systems — Login Safety, Session Security & Rate-Limits

IDCheckPasses whenWeightRuns
6.59.51Validate login over HTTPSHTTPSCriticalDeterministic
6.59.52Validate passwords hashed with strong algorithmsStrongCriticalDeterministic
6.59.53Validate session cookies secureSecureCriticalDeterministic
6.59.54Validate session cookies HttpOnlyHttpOnlyHeavyDeterministic
6.59.55Validate session expiration correctCorrectHeavyDeterministic
6.59.56Validate MFA configurable (if applicable)ConfigurableHeavyDeterministic
6.59.57Detect insecure password reset endpointsNoneMediumDeterministic
6.59.58Validate login brute‑force rate‑limitsPresentMediumDeterministic
6.59.59Detect session fixation risksNoneMediumDeterministic
6.59.60Validate logout invalidates sessionInvalidatedMediumDeterministic

Bot Safety — Good Bot Allowlisting, Bad Bot Mitigation, Scraping Control

IDCheckPasses whenWeightRuns
6.59.61Validate AI‑crawlers (OpenAI, Anthropic, Perplexity) allowedAllowedHeavyDeterministic
6.59.62Validate no blocking of Googlebot/Bingbot/YandexAllowedHeavyDeterministic
6.59.63Validate rate‑limit protection on bad botsActiveHeavyDeterministic
6.59.64Detect scraping from suspicious IPsMinimalMediumDeterministic
6.59.65Validate robots.txt safe & not overly restrictiveSafeMediumDeterministic
6.59.66Validate bot protection does not block rendering botsNot blockedMediumDeterministic
6.59.67Detect firewall blocking legitimate botsNoneMediumDeterministic
6.59.68Validate autoscaling handles bot spikesHandlesMediumDeterministic
6.59.69Detect bot loops abusing API endpointsNoneMediumDeterministic
6.59.70Validate bot behavior logs retainedRetainedMediumDeterministic

AI-Safe Surface — Content Sanity, Indexation Safety & Harmlessness Checks

IDCheckPasses whenWeightRuns
6.59.71Validate page contains no malicious script injectionsCleanHeavyDeterministic
6.59.72Validate HTML safe for LLM parsingSafeHeavyDeterministic
6.59.73Validate iframe embeds safe (no malicious sources)SafeHeavyDeterministic
6.59.74Detect phishing‑like outbound linksNoneMediumDeterministic
6.59.75Validate no surprise executable downloadsNoneMediumDeterministic
6.59.76Validate text free of harmful encoded payloadsCleanMediumDeterministic
6.59.77Validate images/media clean of malicious EXIFCleanMediumDeterministic
6.59.78Validate AI‑extractable content not misleadingConsistentMediumDeterministic
6.59.79Validate no cloaking for AI‑crawlersNoneMediumDeterministic
6.59.80Validate AI‑metadata (llms.txt etc.) harmlessHarmlessMediumDeterministic

Malware & Threat Surface — Scanning, Server Cleanliness & Compromise Checks

IDCheckPasses whenWeightRuns
6.59.81Validate site not flagged for malwareCleanCriticalDeterministic
6.59.82Validate no injected JS malwareNoneHeavyDeterministic
6.59.83Validate no hidden iFramesNoneHeavyDeterministic
6.59.84Validate no SEO‑spam injectionNoneHeavyDeterministic
6.59.85Validate no unauthorized .php uploadsNoneMediumDeterministic
6.59.86Validate server directories inaccessible externallyInaccessibleMediumDeterministic
6.59.87Validate package dependencies free of known CVEsCleanMediumDeterministic
6.59.88Detect malware calling home (network anomalies)NoneMediumDeterministic
6.59.89Validate no suspicious scheduled tasks/cronCleanMediumDeterministic
6.59.90Validate server logs show no intrusion attemptsCleanMediumDeterministic

Final Security Summary — Hardening, Bot-Safety & AI-Safe Surface

IDCheckPasses whenWeightRuns
6.59.91Validate no critical vulnerabilities openNoneHeavyDeterministic
6.59.92Validate all security headers presentPresentHeavyDeterministic
6.59.93Validate encryption & TLS fully secureSecureHeavyDeterministic
6.59.94Validate authentication systems safeSafeHeavyDeterministic
6.59.95Validate overall attack surface minimalMinimalMediumDeterministic
6.59.96Validate bot behavior safe & stableSafeMediumDeterministic
6.59.97Validate AI‑safe surface cleanCleanMediumDeterministic
6.59.98Validate no sensitive endpoints indexedNoneMediumDeterministic
6.59.99Validate security scoring formulas appliedCorrectMediumDeterministic
6.59.100Compute Final Security & AI‑Safe Surface ScoreFinalizedCriticalDeterministic

← 6.58 Performance, Core Web Vitals, Speed, User Experience Signals & AI-Usability Interpretation6.60 Analytics, Tagging, Event Tracking, Data Quality & AI-Observability Signals →

Run these checks on your site

A Deep Audit scores every check here that applies to your page, then an AI pass of up to 150 checks. Included on Pro and Ultra, or $9 for one audit.

See plans

Machine-readable: catalog totals and the full catalog as JSON (IDs, section, weight, status).