[ SEC-INDEX // VECTOR CATALOGUE ]
On every audit, CheckCyber inspects 24 non-intrusive security vectors, grouped into 5 families. Here is the full list — what each check measures, why it matters, and the guide to fix it.
[ FREE · ANONYMOUS · NO ACCOUNT ]
[ FAMILY 01 // 5 VECTORS ]
The trust layer: everything that protects the connection between visitor and server.
[MEASURES]Opens a TLS handshake to read the certificate: validity, issuer, expiry date and negotiated protocol.
[RISK]An expired, invalid or missing certificate breaks encryption: exchanged data can be read or altered by a third party.
▸ Fix guide[MEASURES]Evaluates the size and type of the certificate public key (RSA, elliptic curve).
[RISK]An RSA key below 2048 bits is too short and could eventually be broken by brute force.
▸ Fix guide[MEASURES]Attempts a TLS 1.0/1.1-only handshake to detect whether the server still accepts these versions.
[RISK]TLS 1.0 and 1.1 are vulnerable to known attacks (BEAST, POODLE) and should no longer be accepted.
▸ Fix guide[MEASURES]Checks that the unencrypted http:// version of the site automatically redirects to https://.
[RISK]Without a redirect, a visitor arriving over HTTP stays exposed to interception before ever reaching the secure version.
▸ Fix guide[MEASURES]Presence and quality of the HSTS header: duration (max-age), subdomain coverage, preload.
[RISK]HSTS forces the browser to use HTTPS only, blocking attempts to downgrade to a cleartext connection.
▸ Fix guide[ FAMILY 02 // 7 VECTORS ]
The instructions sent to the browser to protect your visitors directly.
[MEASURES]Presence and strictness of the CSP, the main barrier against script injection (XSS) in the browser.
[RISK]Without a CSP — or with one weakened by unsafe-inline/unsafe-eval — an attacker can run malicious scripts on your visitors.
▸ Fix guide[MEASURES]Checks the header that prevents your site from being displayed in a third-party iframe.
[RISK]Without it, a malicious site can overlay your page to hijack user clicks (clickjacking).
▸ Fix guide[MEASURES]Verifies the nosniff header that stops the browser guessing a file’s type.
[RISK]MIME sniffing can lead the browser to execute a file as a dangerous, unintended type.
▸ Fix guide[MEASURES]Presence of the header governing the referrer information sent to external sites.
[RISK]Without a Referrer-Policy, your pages’ full URLs can leak to the third-party sites your visitors browse.
▸ Fix guide[MEASURES]Checks the header restricting access to sensitive browser APIs (camera, microphone, geolocation).
[RISK]Without restrictions, a compromised resource could reach for powerful browser capabilities.
▸ Fix guide[MEASURES]Analyses the Secure, HttpOnly and SameSite attributes of cookies set by the server.
[RISK]A session cookie without these attributes can be stolen (XSS) or abused (CSRF), compromising user accounts.
▸ Fix guide[MEASURES]Detects a permissive cross-origin policy (wildcard * combined with credential sharing).
[RISK]A misconfigured CORS policy lets a third-party site read your users’ authenticated data.
▸ Fix guide[ FAMILY 03 // 5 VECTORS ]
What your server reveals, sometimes without knowing it.
[MEASURES]Probes for publicly reachable files: .env, .git repository, backups, phpinfo, server-status…
[RISK]These files can hand an attacker your secrets, your source code or your entire configuration.
▸ Fix guide[MEASURES]Reads robots.txt looking for sensitive paths (admin, backup, config…) revealed publicly.
[RISK]Listing sensitive directories in robots.txt amounts to handing an attacker a valuable map.
▸ Fix guide[MEASURES]Enumerates the allowed HTTP methods through an OPTIONS request (TRACE, PUT, DELETE, CONNECT…).
[RISK]Unnecessary methods left enabled widen the attack surface and may allow unintended operations.
▸ Fix guide[MEASURES]Detects version banners exposed in headers (Server, X-Powered-By, X-AspNet-Version…).
[RISK]Knowing your exact versions helps an attacker go straight for matching public exploits.
▸ Fix guide[MEASURES]Looks for a /.well-known/security.txt file (RFC 9116) stating how to report a vulnerability.
[RISK]Without a contact channel, a researcher who finds a vulnerability has no responsible way to reach you.
▸ Fix guide[ FAMILY 04 // 3 VECTORS ]
Protecting your identity beyond the site itself: DNS and email.
[MEASURES]DNS check of the SPF and DMARC records, and of how strict the DMARC policy is (none, quarantine, reject).
[RISK]Without enforced SPF and DMARC, an attacker can send phishing emails impersonating your domain name.
▸ Fix guide[MEASURES]Verifies the CAA DNS record restricting which authorities may issue your certificates.
[RISK]Without CAA, any certificate authority can issue a valid certificate for your domain.
▸ Fix guide[MEASURES]DNS check of the MTA-STS and TLS-RPT policies that enforce and monitor encryption of inbound SMTP.
[RISK]Without MTA-STS, an attacker can downgrade delivery of your inbound email to cleartext and intercept it.
▸ Fix guide[ FAMILY 05 // 4 VECTORS ]
What the page actually loads, and what it is built with.
[MEASURES]Detects active resources (script, stylesheet, iframe) loaded over unencrypted http:// on an HTTPS page.
[RISK]An active cleartext resource on a secure page can be intercepted and modified to inject code.
▸ Fix guide[MEASURES]Checks the integrity attribute (Subresource Integrity) on scripts loaded from a third-party domain.
[RISK]Without SRI, compromising a third-party CDN is enough to inject malicious code into your site unnoticed.
▸ Fix guide[MEASURES]Analyses loaded scripts to spot library versions (jQuery, Bootstrap…) with known vulnerabilities.
[RISK]An outdated front-end library reintroduces public flaws (often XSS) that were already fixed elsewhere.
▸ Fix guide[MEASURES]Uses exposed banners to detect server software (PHP, Apache, nginx…) running an out-of-support version.
[RISK]End-of-life software receives no more security fixes: its vulnerabilities stay open permanently.
▸ Fix guide[ METHODOLOGY // 100% DETERMINISTIC ]
Every vector is measured technically and reproducibly, with no artificial intelligence involved. Each detected flaw applies a penalty to the starting score (100) according to its severity: critical, medium or low. The same measurements always produce the same score. See the details on the methodology page, or browse all the security guides.
[ CheckCyber // SURFACE-AUDIT ENGINE ]