Website check guides

Every CheckWeb scan grades a site across five axes, and Security is the heaviest of them. The guides below take the security findings that cost the most, explain what each one means for a live site, and end where the fix can be confirmed: another scan. The SEO faults a scan finds have their own guides, linked below.

• Vulnerable JavaScript librariesOld jQuery, Bootstrap, or Angular still shipping to every visitor, with CVEs counted per version rather than per package.
• WordPress securityAn outdated core, the plugins and themes that bundle vulnerable libraries, and what a passive scan can safely see from the outside.
• CMS known vulnerabilitiesAn outdated core with known CVEs on Joomla, Drupal, TYPO3, Magento, PrestaShop, or Bitrix, counted per version, and how a passive scan sees it from the outside.
• Core security headersThe three headers that cost almost nothing to set, and the failure more sites hit than any other.
• HSTS (Strict-Transport-Security)One line that stops a browser from ever falling back to plain HTTP, and how to roll it out without locking anything out.
• Content-Security-PolicyThe strongest single defense against cross-site scripting, and how to add one without breaking the page.
• HTTPS & HTTP→HTTPS redirectThe heaviest check in the scan: a site that stays reachable over plain HTTP has its whole score capped at 40.
• SSL/TLS certificateExpiry, hostname coverage, and the chain, plus the early warning that turns a renewal into a task instead of an outage.
• Mixed contentThe http:// assets still loading on an HTTPS page, blocked by the browser or quietly costing the padlock.
• Exposed .git directoryA served .git folder hands over the full source and every secret ever committed to it, history included.
• Exposed .env fileThe one file that holds the database password and every API key a site runs on, and the three ways it ends up publicly readable.
• Exposed secrets and API keysThe wider catalogue: config files, private keys, cloud credentials, database dumps, editor backups and AI tool configs.
• API keys in front-end codeKeys compiled into the page and its JavaScript, readable by every visitor, and the ones that are meant to be there.
• Public source mapsA .js.map left in production turns the minified bundle back into readable source, comments included.
• Subdomain takeoverA DNS record left pointing at a service that was shut down, and the stranger who can register it and answer on the domain.
• XML-RPC enabledThe WordPress endpoint that accepts a hundred password attempts in one request, and the pingback method that aims the server at somebody else.
• WordPress user enumerationHow a WordPress site hands out its account names to anyone who asks, and why a known login is half of a break-in.
• CORS misconfigurationThe cross-origin setting that lets any website read a signed-in visitor's data, and the wide-open one that is harmless.
• GraphQL introspectionThe default that publishes every type, field and mutation an API has, including the ones nothing on the site calls.
• Public storage bucketWhy a bucket that lists its contents is a different problem from one whose files are readable, and how to close it.
• Directory listingAn auto-generated index turns a folder of backups or uploads into a browsable list, no filenames needed.
• Blacklisting & Safe BrowsingWhat a listing on Safe Browsing or a DNS blocklist costs, why it caps the score hardest, and how a delisting review works.