Website Security Audit

Fetch a site once and grade its transport security, HTTP security headers, HSTS preload readiness, security.txt, cookie flags and mixed content on an A–F scale. It is a quick overview, not a penetration test.

Audit

Domain Checked from the OrbitNet server over HTTPS (with a plain-HTTP fallback).

What is graded

Each row has a weight and a score from 0 to 1; the grade is their weighted average. A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, E ≥ 50, otherwise F.

HSTS preload

The preload row only checks that the header has max-age=31536000, includeSubDomains and preload. Actually being on the preload list also requires submitting the domain at hstspreload.org.

security.txt

The audit looks for /.well-known/security.txt and then /security.txt, and reads the Contact and Expires fields as defined by RFC 9116.

Mixed content and cookies

Mixed content is detected by scanning the returned HTML for http:// resources; namespace URLs such as http://www.w3.org/ are ignored. Cookie flags are read from Set-Cookie on the first response only. Because these checks need the page body, a result fetched through the Cloudflare Worker fallback (during DNS filtering or blocking) leaves them as Unknown.

Scope and privacy

Only the requested host is checked, from the OrbitNet backend. The audit does not follow redirects and does not test for vulnerabilities. Like every server-side check it appears in standard infrastructure logs.