Built GuardHawk — a one-click website security audit tool. Point it at any domain you own or manage, get a full report back in seconds: no login, no agent installed, nothing invasive — just reads what's already publicly checkable (the same way a browser or a certificate authority would).
What it checks, all in one run:
✅ SSL/TLS certificate (valid, expiry, issuer)
✅ DNS records + DNSSEC
✅ Email security — SPF, DKIM, DMARC (is your domain spoofable by phishers?)
✅ Security headers (HSTS, CSP, Permissions-Policy…)
✅ Subdomain-takeover risk (a dangling DNS record pointing to a service you don't control anymore — a real, common way domains get hijacked)
✅ Public cloud-storage exposure (accidentally public S3 buckets)
✅ Tech stack, WHOIS, blacklist status
✅ A 0-100 health score + a plain-English fix list
Real example — ran it just now:
I ran GuardHawk against github.com:
🔗 github.com — 94/100 (Grade A)
✅ SSL/TLS checked
✅ SPF, DKIM & DMARC checked
✅ Security headers checked
✅ No subdomain takeover risk detected
✅ No public cloud buckets detected
✅ Blacklist status checked
⚡ Response time: 72 ms
It still identified 2 issues worth reviewing:
⚠️ Permissions-Policy header missing
⚠️ DNSSEC not enabled
That's exactly what GuardHawk is built for — giving you a quick view of what is configured correctly and what still needs attention. Even a site the size of GitHub has fixable gaps — nobody's perfect, you just need to actually see the list.
Where this fits:
🔧 Agencies & MSPs auditing client sites before onboarding
🤖 Drop it into an n8n workflow for scheduled security monitoring across a whole portfolio of domains
🔗 Runs on Apify — one domain or bulk-audit hundreds, no API key needed
🔗 apify.com/inexhaustible_glass/domain-health-audit
What's the last security gap you found on a "trusted" site? 👇
Top comments (0)