Web Check · feature

Website security check (a passive look at headers, TLS, DNS and open ports)

A website security check in Web Check answers a plain question: what does your server show to anyone who asks? Enter a page address and the service reads the public responses, then returns a report with a score and a list of remarks sorted by importance. It suits site owners, administrators and developers who want to catch a missing header, a weak certificate setup or a forgotten open port before someone else does.

Website security check report with header, TLS, DNS and open port cards

What a website security check covers

The checks are grouped by what they look at. Each one is a section of the full audit and its own API endpoint:

Headers. http-security reads Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Transport and certificate. ssl, tls-connection, tls-labs and hsts.
DNS and mail. dns, dns-server, dnssec, txt-records and mail-config.
Exposed surface. ports for open ports, firewall for signs of a WAF, subdomains, trace-route, whois and security-txt.
Page content and reputation. mixed-content finds http resources on an https page, cookies lists cookies, privacy finds trackers, threats and block-lists look at blacklists, tech-stack detects the technologies in use and shodan adds to the picture from outside.

How the report is built, step by step

You enter a page address, or call the API with the url parameter.
Web Check requests the public responses of the server and the related records: headers, certificate, DNS, mail settings, open ports.
The result of every section goes into the JSON and into its own card in the report.
The summary combines everything into a score and a list of remarks, each with an importance level.

A website security check returns a lot of data, so start from the remarks of the highest importance and move down the list; the card of the section shows the raw result behind each remark.

Security headers and how much each one weighs

In the summary audit the six headers read by http-security have different importance:

Strict-Transport-Security (HSTS): high;
Content-Security-Policy (CSP): high;
X-Frame-Options: medium;
X-Content-Type-Options: medium;
Referrer-Policy: low;
Permissions-Policy: low.

A separate hsts check sits in the transport group, so the HSTS policy is looked at from two sides.

What you get from the report

A score and a list of remarks sorted by importance, from high to low.
One card per section, with the same data available as JSON.
A view of the outer surface of the site: open ports, subdomains, the route to the server, whois data and the security.txt file.
Trackers, cookies and blacklist hits in one place.

A repeated website security check after the fixes shows which remarks are gone.

Where it helps and how to run it

After a deployment. Look at the headers and at the transport group to confirm that the new setup is what you meant.
After moving to https. mixed-content shows http resources that are still loaded on an https page.
When reviewing mail and DNS. mail-config, txt-records and dnssec are collected in one report.

For a single group use its check name, or call the whole set:

GET https://webcheck.asibots.pro/api/http-security?url=PAGE_URL
GET https://webcheck.asibots.pro/api/audit-full?url=PAGE_URL

Honest limits of a passive scan

This website security check is passive: it reads public responses of the server and does not try to break in. Testing a chatbot is a separate function, described on the AI chatbot security page.
The service rejects addresses inside an internal network (localhost, private ranges, cloud metadata) with a 400 answer, so it cannot serve as a window into someone's internal network.
Port scanning and trace-route are limited to 6 requests per minute.
Heavy checks with a browser (screenshot, cookies, tech-stack, audit-full) run at most 4 at a time for all visitors together and 12 per minute for one visitor. Above a limit you get a 429 answer with a clear text.
A full audit takes around 40 seconds; a response through Cloudflare is capped at 100 seconds.

Frequently asked questions

Does the website security check try to hack my site?

No. It is passive and reads only what the server answers to a public request. It does not try to break in or exploit anything.

Which checks have the strictest limits?

Port scanning and trace-route allow 6 requests per minute. Heavy checks with a browser, such as screenshot , cookies , tech-stack and audit-full , allow 12 per minute for one visitor and no more than 4 at once across the service.

Can I run a website security check from code?

Yes. Any check is available as GET /api/<check>?url=… and returns JSON. audit-full returns the score, the issues sorted by importance and the data of all sections.

Check my site