Skip to content
ITDWeb Security Platform
ITD
Search

Site Security Audit

A bounded check of a site you own or manage: secret exposure (.env/.git/DB dumps), TLS certificate, HTTP security headers, CSP weaknesses and CORS misconfiguration, cookie flags, email authentication and CAA — plus correlation of exposed products against our CISA KEV catalog. A graded report with fixes and an AI fix prompt.

Preparing a browser-specific code uses a temporary required cookie and does not contact the target site. When you run the audit, this site's server uses DNS and HTTPS to check code placement, then makes bounded requests to fixed public paths and settings. It does not fuzz paths or attempt exploitation. Internal/private addresses are blocked.

Use the tool

Result display and the domain you enter

Completed results are returned directly to this page, without a server-side result store. Reloading clears the result and does not run another audit. The revoke control also clears the displayed result.

The domain you enter may remain in URLs or access logs. Do not enter passwords, connection details or personal information.

How to use

  1. 1

    Enter your own site's domain

    e.g. example.com. Use only a site you own or manage. Preparing a code does not contact the target site; it creates a temporary browser session.

  2. 2

    Place the code (any one of three ways)

    Place the shown token via ①a meta tag (easiest — just paste into your homepage <head>), ②a DNS TXT record, or ③a file (one-click download → drop it in /.well-known/). The audit won't start until it's verified.

  3. 3

    Select 'Verify code placement & run audit'

    It checks secret exposure (.env/.git/DB dumps), TLS cert, headers, CSP/CORS, cookies, email auth and KEV correlation (actively-exploited CVEs), and shows an A–F overall grade.

  4. 4

    Fix from red to amber

    Each item shows why it's risky and how to fix it. A copy-paste AI prompt is included — paste it into ChatGPT / Claude for steps tailored to your stack.

  5. 5

    Recheck manually when needed

    Monitoring sign-ups are paused. Use this page for another manual audit when needed; there is no monitoring registration form.

Why it matters

This tool checks a fixed set of sensitive-file paths, TLS settings, headers, cookie flags, email authentication and version disclosure for a site you own or manage. A browser-specific code must be confirmed on the target site or its DNS before detailed checks begin. This limits unauthorized use; it does not verify personal identity or guarantee that misuse is impossible.

FAQ

QWhy is a verification code required?
A

Sensitive-file checks must be limited to sites you own or manage. Before detailed checks, the tool verifies a browser-specific code in DNS, an HTTPS homepage meta tag, or an HTTPS file. This confirms placement of the code, not your personal identity or legal ownership.

QDoes the audit load my site heavily?
A

The audit makes bounded requests to a fixed set of paths and settings, including sensitive-file checks, plus DNS queries. Some requests run in parallel, and permitted redirects can add requests. It does not fuzz paths or attempt exploitation.

QIf the grade is high, am I fully safe?
A

No. It checks representative high-signal items, not every possible risk. Don't over-trust a green result; pair it with least-exposure/least-privilege and ongoing checks of dependencies (OSV scanner), headers and email auth.

Related