Website Security Audit
SSL/TLS, security headers, email spoofing prevention (SPF/DKIM/DMARC), and exposed paths.
A public-surface security audit checks signals an outsider can see without credentials. AuditHQ inspects SSL/TLS configuration, response headers, email authentication (SPF/DKIM/DMARC), and exposed sensitive paths. CVE references are sourced from the NIST National Vulnerability Database where applicable.
Scope note. This audit checks public website security signals (TLS, headers, DNS, email auth, exposed paths). It is not a penetration test or an authenticated application security review.
Audit suite
Security
Verified checks
Example findings
10
Every check verified against live data.
Grouped into 6 categories. Code runs every check against your live site - AI only writes the narrative around verified findings. Methodology is proprietary; the cards below describe what each category catches.
01
18 checksSSL/TLS
TLS version, certificate health, HTTPS enforcement, post-quantum readiness, and connection-level hardening.
02
22 checksSecurity Headers
22 checks against the security settings your website sends to every visitor's browser - the digital equivalent of locks on doors. These stop browsers being tricked into running malicious code, force secure connections, and clear old login sessions properly (OWASP-recommended headers: CSP, HSTS, COOP/COEP/CORP, Reporting-Endpoints, cookie hardening, Clear-Site-Data on logout).
03
14 checksEmail Authentication
SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT - every signal that protects against domain spoofing and phishing impersonation.
04
6 checksCMS & Software
Detected CMS/framework version cross-checked against the NIST National Vulnerability Database for known exploitable CVEs.
05
5 checksInformation Exposure
What attackers can learn before they even probe - server version disclosure, exposed admin paths, .git/.env leaks, security.txt presence.
06
5 checksThird-Party Risk
Third-party script supply-chain hygiene - Subresource Integrity, sandbox attributes, and total external script load.
Specific check definitions, regex patterns, and severity rubrics are not published. The output is a verified, evidence-backed report - not a methodology document.
Three things that quietly cost you customers.
Without DMARC, anyone can send email pretending to be you.
A missing DMARC record means attackers can spoof your domain in phishing emails to your customers. Recipients see "from: you@yourcompany.com" and trust it. Major email providers (Google, Microsoft) increasingly mark DMARC-less domains as suspicious, hurting deliverability for your real mail too.
unsafe-inline in your CSP defeats the entire point of having one.
Content Security Policy is the single biggest browser-side defence against XSS. But many CSPs include "unsafe-inline" in script-src, which allows any inline script to run - exactly what CSP is supposed to block. The audit flags this and shows the right configuration for Vite, Next.js, or Vercel deployments.
Server version headers are reconnaissance gifts.
A header like "Server: nginx/1.18.0" tells attackers exactly which CVEs to try. Modern best practice is to suppress version disclosure entirely. The audit identifies any version-revealing header and shows the config snippet to suppress it.
No SPF or DMARC record - anyone can spoof your email domain
Evidence
DNS lookup for _spf.yourdomain.com returns NXDOMAIN. DNS lookup for _dmarc.yourdomain.com returns no record. This means any sender on the internet can send email with "From: anyone@yourdomain.com" and most receiving servers will accept it.
Recommended fix
1) Publish SPF record: `v=spf1 include:_spf.google.com ~all` (adjust for your sending provider). 2) Publish DMARC record at _dmarc.yourdomain.com: `v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com`. 3) Configure DKIM at your email provider. Validate with mxtoolbox.com.
Business impact
Domain spoofing is a top vector for invoice fraud, executive impersonation, and customer phishing. A single successful spoofing attack on a B2B target can cost six figures. Beyond fraud, missing SPF/DMARC actively hurts deliverability of your legitimate marketing email.
Fictional example of the evidence, fix and impact structure. It is not a current report or a finding about your site.
Questions, answered.
What buyers ask before running their first security audit.
Stop reading. Start auditing.
Audit your security stack now.
Create an account to start a Full Audit. This suite includes 100 catalogue checks; applicability depends on your site and scope. Review recorded evidence and a prioritised action plan.