Security config
Security headers a crawler can see (not a pentest)
· Configuration notes, not a newsroom.
HSTS, CSP, framing, cookie flags — the public configuration SiteRune scores. What we will not scan, and how we write nginx / Vercel / WordPress snippets.
Public config only
SiteRune looks at response headers, cookie flags, mixed content in HTML, and version banners in generator tags. It does not fuzz, brute-force, or weaponize findings. If a page says 'this is not a pentest' and then ships an exploit PoC, that product is lying. We do not.
The matrix we actually score
On the final URL after redirects:
- HTTPS and HSTS (max-age, includeSubDomains — we do not invent preload).
- Content-Security-Policy presence and unsafe-inline / * wildcards on HTML and JSON, not on gtag.js.
- X-Frame-Options or CSP frame-ancestors.
- Cookie Secure / HttpOnly / SameSite on Set-Cookie.
- Mixed http:// assets on an https page.
CSP is easy to break
We will draft a CSP. We will also tell you to review it before enforcing. A copy-paste policy that blocks your own checkout is worse than no policy. The ship tab is a starting point for an engineer, not a compliance certificate.
Run it on a live URL
The brief will name your CMS and attach the files. Three guest scans, no card.