Enterprise Web Security & Vulnerability Auditor

Free Website Security Scanner — Vulnerability & Headers Auditor

Audit any website’s defensive security posture in seconds. Inspect HTTP security headers (CSP, HSTS, X-Frame-Options, MIME sniffing), cookie flags (HttpOnly, Secure, SameSite), SSL/TLS transport encryption, server version information leaks, and brute-force / WAF defense readiness. 100% free with copy-paste remediation code.

Good Security Hardening

/ 100

Target: https://example.com

0 Critical 2 Warnings 8 Passed WAF: Detected

Web Server Security Hardening Snippets

Copy and paste these verified rules into your web server configuration to remediate missing headers and achieve an A+ security rating.

Apache / LiteSpeed (.htaccess) Configuration

<IfModule mod_headers.c>
    # 1. Content Security Policy (Mitigate XSS and Data Injection)
    Header always set Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline'; object-src 'none'; frame-ancestors 'self';"

    # 2. HTTP Strict Transport Security (Enforce HTTPS for 1 Year)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # 3. Clickjacking Defense (Prevent Malicious Iframing)
    Header always set X-Frame-Options "SAMEORIGIN"

    # 4. MIME-Type Sniffing Protection
    Header always set X-Content-Type-Options "nosniff"

    # 5. Referrer Policy (Protect Sensitive URL Parameters)
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # 6. Permissions Policy (Restrict Hardware Sensors)
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

    # 7. Unset Server Version Tokens (Information Leakage Defense)
    Header unset X-Powered-By
    Header unset Server
</IfModule>

Nginx Server Block (nginx.conf)

# Place inside your server { ... } block:

# 1. Content Security Policy
add_header Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline'; object-src 'none'; frame-ancestors 'self';" always;

# 2. Strict Transport Security (HSTS)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# 3. Clickjacking Defense
add_header X-Frame-Options "SAMEORIGIN" always;

# 4. MIME Confusion Protection
add_header X-Content-Type-Options "nosniff" always;

# 5. Referrer Policy
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# 6. Permissions Policy
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# 7. Mask Server Tokens
server_tokens off;

WordPress Theme (functions.php)

// Add to your active theme's functions.php:
add_action( 'send_headers', function () {
    if ( ! is_admin() ) {
        header( "X-Frame-Options: SAMEORIGIN" );
        header( "X-Content-Type-Options: nosniff" );
        header( "Referrer-Policy: strict-origin-when-cross-origin" );
        header( "Permissions-Policy: camera=(), microphone=(), geolocation=()" );
        header( "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload" );
        header( "Content-Security-Policy: default-src 'self' https: data: 'unsafe-inline'; object-src 'none'; frame-ancestors 'self';" );
    }
} );

Next.js (next.config.js)

// Add to next.config.js:
module.exports = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [
          { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
          { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
          { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains; preload' },
          { key: 'Content-Security-Policy', value: "default-src 'self' https: data: 'unsafe-inline'; object-src 'none'; frame-ancestors 'self';" },
        ],
      },
    ];
  },
};

Received HTTP Response Headers

DEFENSIVE ARCHITECTURE MATRIX

Essential HTTP Security Headers & Vulnerability Defenses

How modern browser security headers prevent web attacks, unauthorized data access, and session hijacking

Security Header	Target Vulnerability	Recommended Value	Severity if Missing	Browser Enforcement Mechanism
Content-Security-Policy	Cross-Site Scripting (XSS), Data Injection, Malicious iFrames	default-src ‘self’ https:; object-src ‘none’;	Critical (-25 pts)	Restricts domains from which scripts, styles, fonts, and images can execute.
Strict-Transport-Security (HSTS)	Man-in-the-Middle (MitM), SSL-Stripping, Session Hijacking	max-age=31536000; includeSubDomains; preload	High (-20 pts)	Instructs browsers to strictly refuse unencrypted HTTP connections for all future visits.
X-Frame-Options	Clickjacking, UI Redress, Invisible Overlay Exploits	SAMEORIGIN or DENY	Medium (-15 pts)	Forbids third-party domains from loading your web pages inside transparent <iframe> wrappers.
X-Content-Type-Options	MIME-Type Sniffing, Script Confusion, Polyglot Uploads	nosniff	Medium (-10 pts)	Forces browsers to respect declared Content-Type, stopping malicious image uploads from running as scripts.
Referrer-Policy	URL Parameter Leakage, Token Exposure to Third-Party Trackers	strict-origin-when-cross-origin	Low (-5 pts)	Strips path and query strings when navigating from HTTPS to external third-party origins.
Permissions-Policy	Unauthorized Hardware Sensor Access (Cam, Mic, GPS)	camera=(), microphone=(), geolocation=()	Low (-5 pts)	Disables access to device peripherals unless explicitly authorized by the top-level application.

WEBSITE HARDENING GUIDE

How to Secure Your Website & Eliminate Common Vulnerabilities

A practical checklist for web developers, DevOps engineers, and website owners

1. Enforce HTTPS Everywhere with Full HSTS Preloading

Modern web security begins with transport encryption. Ensure your web server automatically returns an HTTP 301 Permanent Redirect to HTTPS for all incoming port 80 traffic. Enable Strict-Transport-Security with a minimum max-age of one year (31,536,000 seconds) and submit your domain to the official Chromium HSTS preload list.

2. Eliminate Cross-Site Scripting (XSS) with Content-Security-Policy

XSS accounts for a massive percentage of web application breaches. By declaring an explicit Content-Security-Policy (CSP), you restrict executable scripts strictly to verified domains. Avoid using 'unsafe-inline' or 'unsafe-eval' whenever possible, and set object-src 'none' to prevent legacy Flash or plugin exploits.

3. Protect Session Cookies with HttpOnly, Secure, and SameSite Flags

Session cookies hold the keys to user accounts. Always configure session cookies with HttpOnly (preventing client-side JavaScript access), Secure (guaranteeing transmission solely over encrypted TLS), and SameSite=Lax or SameSite=Strict (blocking Cross-Site Request Forgery attacks).

4. Deploy an Edge Web Application Firewall (WAF) to Prevent Brute-Force Floods

To defend login portals and REST APIs against automated brute-force attacks and credential stuffing, place your domain behind an edge reverse proxy (such as Cloudflare, AWS CloudFront, or Fastly). Configure rate limiting rules that return HTTP 429 Too Many Requests when multiple failed attempts occur within short intervals.

5. Mask Server Banners and Disallow Directory Indexing

Automated vulnerability scanners search the web for servers advertising unpatched software versions. Disable Apache’s ServerTokens (set to Prod) and Nginx’s server_tokens off;, and remove the X-Powered-By: PHP header to deny attackers reconnaissance intelligence.

Need Enterprise Web Security Auditing, Penetration Defense, or Custom Web Architecture?

UCDREAMS engineers battle-hardened web applications, high-performance web platforms, and automated digital tools. Partner with our senior full-stack development team with zero upfront design cost through our exclusive agency pilot program.

Apply for Pilot Program →

FREQUENTLY ASKED QUESTIONS

Everything You Need to Know About Website Security & Vulnerability Auditing

Common questions regarding security headers, vulnerability testing, and defensive posture

What does this website security auditor check?

Our security scanner performs a non-invasive, passive security posture audit of any public website. It evaluates HTTP security headers (CSP, HSTS, X-Frame-Options, MIME sniffing, Referrer-Policy, Permissions-Policy), SSL/TLS configuration, cookie security flags (HttpOnly, Secure, SameSite), server banner information leaks, and edge WAF / brute-force rate-limiting defenses.

Does this scanner perform active hacking or intrusive exploit tests?

No. Active exploit injection (such as firing destructive payloads or launching password brute-force floods) is invasive and unauthorized. Instead, our tool acts like institutional auditing platforms (like Mozilla Observatory and SecurityHeaders.io), safely analyzing defensive headers, certificates, and configuration parameters without causing server downtime or data corruption.

How is the 0–100 Security Score and Letter Grade calculated?

The tool starts with a base score of 100 points. Points are deducted based on the severity of missing defenses: -25 pts for missing Content-Security-Policy (XSS exposure), -20 pts for missing HSTS, -15 pts for Clickjacking vulnerability, -10 pts for missing MIME sniffing protection, and deductions for insecure cookies or exposed server versions. Scores 90+ earn an A or A+, 80–89 earn a B, 65–79 earn a C, 50–64 earn a D, and under 50 receive an F.

How can I fix missing security headers on Apache or Nginx?

Click on the “Remediation Code” tab on your audit report. The tool automatically generates ready-to-copy code blocks customized for your web server (Apache .htaccess, Nginx nginx.conf, WordPress functions.php, or Next.js next.config.js). Simply paste the snippet into your server configuration and re-run the scan to verify your A+ rating.

Can missing security headers make my site fail PCI-DSS or SOC2 compliance?

Yes. Standard compliance frameworks (such as PCI-DSS requirement 6.5, OWASP Top 10, and HIPAA security guidelines) require robust encryption in transit (HSTS), protection against cross-site scripting (CSP), and secure session cookie flags (HttpOnly & Secure). Implementing these headers is mandatory for passing automated compliance audits.