What Is a Website Security Checker?
A website security checker is an automated tool that scans a public URL and evaluates its security posture based on observable signals — HTTP response headers, SSL/TLS configuration, cookie attributes, exposed file paths, DNS records, and HTML meta tags.
Unlike penetration testing tools, a passive security checker does not attempt to exploit vulnerabilities. It reads what your server openly broadcasts and flags anything that violates modern security best practices. Think of it as a security audit you can run in 10 seconds, for free, from your browser.
This tool is specifically built for indie founders and product builders who are preparing to launch. A product with poor security signals loses trust before a single user signs up.
Why Security Headers Matter
HTTP security headers are response headers your server sends alongside every page. Browsers read them and adjust their behavior accordingly — blocking certain types of attacks, refusing to embed your page in iframes, and preventing sensitive data from leaking through the browser cache.
Without them, your users are exposed to:
- XSS (Cross-Site Scripting) — Attackers inject malicious scripts that steal session tokens and user data.
- Clickjacking — Your page is embedded in a hidden iframe and users are tricked into clicking buttons they cannot see.
- Protocol Downgrade Attacks — Without HSTS, attackers intercept the first HTTP request before the HTTPS redirect happens.
- MIME Sniffing — Browsers guess file types incorrectly and execute uploaded files as scripts.
- Referrer Leakage — Sensitive URL parameters are leaked to third-party sites through the Referer header.
Most of these attacks are completely preventable with a handful of response headers that take less than 30 minutes to add.
The 9 Security Categories Explained
🛡️ HTTP Security Headers
HighWhy it matters: These headers are the first line of defense for browser-side attacks. Missing CSP alone opens you to reflected and stored XSS attacks which are among the most exploited vulnerabilities on the web.
How to fix: Add them in your Next.js next.config.ts under the headers() function, your nginx config, or your hosting platform (Vercel supports custom headers in vercel.json).
🔒 TLS / SSL
CriticalWhy it matters: Serving content over HTTP means anyone on the same network can intercept traffic and see everything your users send — passwords, payment info, session tokens. TLS encrypts all of it.
How to fix: Get a free TLS certificate via Let's Encrypt (Certbot) or deploy on Vercel/Netlify which provisions certificates automatically. Enable HSTS to force HTTPS on all future connections.
🍪 Cookie Security
HighWhy it matters: Cookies without the HttpOnly flag can be stolen via XSS. Cookies without Secure flag are sent over HTTP connections. Cookies without SameSite are vulnerable to CSRF attacks.
How to fix: When setting cookies in your API routes, always include: Set-Cookie: name=value; HttpOnly; Secure; SameSite=Strict; Path=/
🔀 Cross-Origin Protections
MediumWhy it matters: Without proper cross-origin headers, attackers can embed your site, read your resources from other origins, and perform Spectre-like side-channel attacks.
How to fix: Add Cross-Origin-Resource-Policy: same-origin and Cross-Origin-Opener-Policy: same-origin headers. Avoid Access-Control-Allow-Origin: * unless you specifically need public API access.
🖥️ Server Information Leakage
MediumWhy it matters: When your server reveals it runs Vercel + Next.js, attackers know exactly which CVEs to look for. Security through obscurity isn't a full defense, but eliminating easy signals is basic hygiene.
How to fix: In Next.js, add poweredByHeader: false to next.config.ts. For the Server header on Vercel, it's controlled by Vercel and cannot be fully hidden, but removing X-Powered-By is achievable.
⚠️ Exposed Files & Paths
CriticalWhy it matters: Accidentally committing .env files, leaving .git accessible, or exposing config.json with credentials is how most indie product breaches happen. It only takes one mistake.
How to fix: Add sensitive files to .gitignore and .vercelignore. Never commit secrets to source control. Use environment variables in your deployment platform instead.
📧 Email Security (SPF & DMARC)
HighWhy it matters: Without SPF and DMARC, anyone can send emails appearing to come from your domain. This is used for phishing your users and damages your sender reputation permanently.
How to fix: Add SPF: v=spf1 include:your-email-provider.com ~all as a TXT record on your domain. Then add DMARC: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com at _dmarc.yourdomain.com.
📤 Social & SEO Meta Tags
MediumWhy it matters: Missing og:image means your product link looks blank when shared on Twitter or LinkedIn. Missing meta description means Google auto-generates one that may not represent your product well. Both cost you clicks.
How to fix: Add og:title, og:description, og:image (1200×630px), and twitter:card to your HTML head. In Next.js, use the Metadata API in your layout.tsx or page.tsx.
🗺️ Robots.txt & Sitemap
MediumWhy it matters: Without a sitemap, search engines discover your pages slowly and may miss them entirely. A misconfigured robots.txt can accidentally block all search engine crawling.
How to fix: Create /robots.txt with: User-agent: *\\nAllow: /\\nSitemap: https://yoursite.com/sitemap.xml. Generate sitemap.xml using next-sitemap or build it manually.
Risk Level Guide
Every check is assigned a severity level that determines how much it affects your score and how urgently it needs to be addressed.
Immediate action required. Directly exploitable vulnerability.
Serious risk that should be addressed before launch.
Moderate risk. Fix when possible — especially before launch.
Best practice improvement. Low immediate risk.
5 Common Security Mistakes Founders Make on Launch Day
Pushing .env to GitHub
The most common and most catastrophic mistake. Exposed API keys get scraped by bots within minutes. Use .gitignore, environment variables in your host, and rotate any key you accidentally exposed.
Skipping HTTPS redirect
Many founders set up HTTPS correctly but forget to redirect HTTP traffic. Users who type your domain without https:// land on an unencrypted connection. Enable HSTS and HTTP→HTTPS redirect in your server config.
No DMARC policy
Launching your product and then having attackers send phishing emails from your domain is a nightmare. Set up SPF + DMARC before you send your first launch email. It takes 10 minutes.
Missing og:image
Your Product Hunt post, Twitter announcement, and newsletter all render as blank link previews. Every tweet about your launch looks like spam. Generate a 1200×630px OG image before you launch.
No Content-Security-Policy
If your app has any user-generated content, a missing CSP means stored XSS attacks can steal your users' session tokens. Even a basic default-src 'self' provides meaningful protection.
Frequently Asked Questions
What does a website security checker test?
A website security checker tests HTTP security headers (CSP, HSTS, X-Frame-Options, etc.), TLS/SSL configuration, cookie security flags, exposed sensitive files, email security records (SPF, DMARC), and social/SEO meta tags — all from a single scan.
Is this website security checker free?
Yes. The WonderLaunch security checker is completely free with no signup required. Results are cached for 10 minutes, and there is a rate limit of 10 scans per minute per IP.
How do I fix missing security headers?
Each failed check includes a specific remediation instruction. For example, adding Content-Security-Policy requires adding a response header in your web server config (nginx, Apache) or in your Next.js next.config.ts headers() function.
What is Content-Security-Policy (CSP)?
Content-Security-Policy (CSP) is an HTTP header that tells browsers which scripts, stylesheets, images, and other resources are allowed to load on your page. It is the single most effective defense against cross-site scripting (XSS) attacks.
What is HSTS (Strict-Transport-Security)?
HSTS is an HTTP header that tells browsers to always use HTTPS when connecting to your site, even if the user types http://. This prevents protocol downgrade attacks and man-in-the-middle attacks on the initial connection.
How does the score work?
Scores start at 100 and deduct points for each failed check based on severity: Critical (-20), High (-10), Medium (-5), Low (-2). INFO items never deduct points. Grades run from A+ (95–100) to F (below 45).
What is SPF and DMARC?
SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting & Conformance) are DNS records that protect your domain from email spoofing. Without them, anyone can send emails pretending to be from your domain.