Home / What Steeplejack checks
Website security check
What can be seen from the outside: certificates, security headers, mixed content, security.txt, and whether the domain is about to lapse.
A free survey only looks, as a browser would. It sends no attack traffic and doesn’t try to break in.
That also means it isn’t a penetration test. A clean result means none of these outside signals raised a concern, not that the site is secure. Software and vulnerability checks are planned for Pro.
Spoofing protection has its own page: email spoofing check.
What the free survey checks
HTTPS certificate, chain, protocols and ciphers
An invalid, expiring or incomplete certificate shows visitors a warning or breaks apps and phones. Old protocols (TLS 1.0/1.1) and ciphers without forward secrecy let attackers downgrade or later decrypt traffic.
HSTS enabled for at least 6 months
HSTS tells browsers to always use HTTPS for your site, preventing downgrade attacks on first visits over public Wi-Fi.
Security headers (CSP, framing, nosniff, referrer, permissions)
Security headers tell the browser to block common attacks: injected scripts (CSP), clickjacking (frame-ancestors), MIME sniffing, referrer leaks and unwanted access to camera or location (Permissions-Policy).
security.txt present and unexpired
security.txt tells researchers how to report a vulnerability to you, instead of publishing it or giving up.
No mixed content; third-party scripts use SRI
Resources loaded over plain HTTP on an HTTPS page can be tampered with in transit. Subresource Integrity (SRI) makes the browser refuse a third-party script if it's been changed.
Domain registration not about to expire
When a domain lapses, the website and every email address on it stop working, and someone else can buy it once the registry releases it.
Privacy notice linked from the homepage
If the site collects personal data, including through analytics cookies or a contact form, UK GDPR requires you to tell people how it's used. A footer link is where people and regulators look. This check only looks for the link, not what the notice says.
Planned for Pro and Expert
These levels aren’t available yet. See the plans.
Pro
- Cookies set with Secure, HttpOnly and SameSite
- Software versions not disclosed
- Software still supported (not end-of-life)
- No known CVEs in detected server-side software
- No front-end libraries with known vulnerabilities
- No exposed files or directories (.git, .env, backups, config)
- No exposed admin or login panels
- CMS-specific security checks
Expert
- No subdomain takeover candidates