Security check guides

Every CheckWeb scan grades a site across five axes, and Security is the heaviest of them. These guides take the findings that cost the most, explain what each one means for a live site, and end where the fix can be confirmed: another scan.

• Vulnerable JavaScript librariesOld jQuery, Bootstrap, or Angular still shipping to every visitor, with CVEs counted per version rather than per package.
• WordPress securityAn outdated core, the plugins and themes that bundle vulnerable libraries, and what a passive scan can safely see from the outside.
• CMS known vulnerabilitiesAn outdated core with known CVEs on Joomla, Drupal, TYPO3, Magento, PrestaShop, or Bitrix, counted per version, and how a passive scan sees it from the outside.
• Core security headersThe three headers that cost almost nothing to set, and the failure more sites hit than any other.
• HSTS (Strict-Transport-Security)One line that stops a browser from ever falling back to plain HTTP, and how to roll it out without locking anything out.
• Content-Security-PolicyThe strongest single defense against cross-site scripting, and how to add one without breaking the page.
• HTTPS & HTTP→HTTPS redirectThe heaviest check in the scan: a site that stays reachable over plain HTTP has its whole score capped at 40.
• SSL/TLS certificateExpiry, hostname coverage, and the chain, plus the early warning that turns a renewal into a task instead of an outage.
• Mixed contentThe http:// assets still loading on an HTTPS page, blocked by the browser or quietly costing the padlock.