Skip to content
srSiteRune
Start free

Public configuration — not a pentest

Website Security Checker

This is a public-configuration review of what a polite crawler sees on the HTML response. It is not a penetration test, not a malware scan, and not a letter you can hand a compliance auditor.

https://

No card. Three guest scans, then an account.

Security checks SiteRune actually runs

  • HTTPS on the final URL (loopback hosts are not failed for HTTP)
  • Strict-Transport-Security presence — we do not invent preload
  • Content-Security-Policy presence (and a drafted policy you must review)
  • X-Frame-Options or CSP frame-ancestors
  • X-Content-Type-Options: nosniff
  • Referrer-Policy
  • Permissions-Policy (or legacy Feature-Policy)
  • Cross-Origin-Opener-Policy as an info finding
  • Server / X-Powered-By version banners
  • Access-Control-Allow-Origin: * on HTML or JSON
  • Mixed http:// assets on an HTTPS page
  • Session-like cookies missing Secure or HttpOnly
  • WordPress: xmlrpc.php in markup; open /wp-json/ as info
  • Missing /.well-known/security.txt (info)

What we will not do

No exploits, no nuclei templates, no credential stuffing

If a vendor scores headers and then attaches a PoC, they mixed jobs. We refuse the second job.

A+ headers and a banned GPTBot can both be true

SecurityHeaders.com grades the header chapter. SiteRune still walks interiors and robots. Use both.

CSP draft is a starting point

A copy-paste policy that blocks checkout is worse than no policy. The ship tab says review before enforce.

How to read the chapter

  1. Headers are taken from the final URL after redirects.
  2. Cookie flags come from Set-Cookie on that response, not from a logged-in session we do not have.
  3. CMS dialect changes the fix text (mu-plugin vs headers() vs Cloudflare in front of Shopify).

Insecure third parties

  • Mixed content is counted from http:// src attributes in HTML.
  • We list third-party script hosts on the performance side. That is exposure information, not an XSS proof.

Questions

Is this a website security audit or a pentest?

A configuration audit of public headers, cookies, and HTML. Hire a pentest for auth, IDOR, and stored XSS.

Do you scan for vulnerabilities in plugins?

We may mention a version banner or an xmlrpc footprint. We do not match CVEs or download wp-admin.

Scan a live URL

Same engine as the rest of SiteRune. Guest scans stay free.

https://