What webzod checks
Every check is passive: DNS queries, a TLS handshake and the requests a browser would make. Each page says what the check looks at, which findings it can report and how to fix them.
Security
- certificate chain and expiry
- certificate names and validity window
- TLS protocol versions
- cipher suites
- HSTS
- HTTP to HTTPS redirect
- Content-Security-Policy
- Clickjacking protection
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Cookie flags
- CORS policy
- Mixed content and SRI
- Version disclosure
- technology fingerprint
- javascript libraries with known vulnerabilities
- cms and framework advisories
- Google Web Risk