The latest articles on DEV Community by IND_is_Here (@indishere). https://dev.to/indishere https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4066346%2F62227a3c-3775-4c0a-9030-5ca0481040d4.png https://dev.to/indishere en IND_is_Here Thu, 06 Aug 2026 18:14:34 +0000 https://dev.to/indishere/radar-scanned-68-distinct-websites-38-security-scans-received-an-f-3jl4 https://dev.to/indishere/radar-scanned-68-distinct-websites-38-security-scans-received-an-f-3jl4 <p>I recently launched <strong>RADAR</strong>, a free website security scanner.</p> <p>It has now run <strong>94 scans across 68 distinct websites</strong>.</p> <p>The part I was not ready for:</p> <ul> <li><strong>38 scan results received an F</strong></li> <li>The median score is only <strong>53/100</strong> </li> <li>F is currently the largest grade category by far 38 of 94 scans, or 40.4%, resulted in an F. That F count is equivalent to 55.9% of the 68 distinct websites scanned.</li> </ul> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Feman8rlxtep49yengxiq.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Feman8rlxtep49yengxiq.png" alt="Radar live statistics dashboard" width="749" height="1059"></a></p> <h2> The websites did not look broken </h2> <p>Most of the sites looked finished and worked normally. In fact, they had a pretty nice UI too. </p> <p>That is what makes the results interesting. A website can load correctly, have a polished interface, and appear production-ready while still missing basic security.</p> <p>The problems Radar commonly looks for include:</p> <ul> <li>Missing or weak Content Security Policy</li> <li>Missing clickjacking protection</li> <li>Missing HSTS</li> <li>Insecure cookie configuration</li> <li>Dangerous CORS settings</li> <li>Mixed HTTP and HTTPS content</li> <li>Missing Subresource Integrity</li> <li>Exposed server or framework information</li> <li>Unsafe redirects</li> <li>Publicly exposed files or information</li> </ul> <p>The visible product may be complete while its security configuration was simply never reviewed.</p> <h2> Why I built Radar </h2> <p>Before building Radar, I used to check websites shared by builders in the Lovable Discord server with RADAR when it was an internal tool I had made.</p> <p>I kept seeing the same protections missing:</p> <ol> <li>Content Security Policy</li> <li>Anti-framing protection through <code>frame-ancestors</code> or <code>X-Frame-Options</code> </li> <li>Permissions Policy</li> </ol> <p>Some owners asked me to scan more of their projects because they had no easy way to check these things themselves.</p> <p>That eventually pushed me to turn the internal scanner into a public tool.</p> <h2> What Radar actually measures </h2> <p>Radar analyzes security information that is publicly observable from a deployed website.</p> <p>It checks areas such as:</p> <ul> <li>HTTPS and redirect behavior</li> <li>Security headers</li> <li>CSP strength</li> <li>Cookies</li> <li>CORS</li> <li>Mixed content</li> <li>External scripts and styles</li> <li>Technology and hosting fingerprints</li> <li>Exposed information</li> </ul> <p>It then produces a readable report with a score and a grade from <strong>F to S+</strong>.</p> <p>There is no login or payment required for a basic scan.</p> <p>The score represents the website’s <strong>publicly visible security configuration</strong>. It is meant to identify overlooked protections and provide a useful starting point, not replace a full security audit.</p> <h2> The statistics are live </h2> <p>The dataset is still early, and the numbers will change as more websites are scanned.</p> <p>The live aggregate statistics are available here:</p> <p><a href="https://radar.hackthe.world/stats" rel="noopener noreferrer">https://radar.hackthe.world/stats</a></p> <p>You can scan your own website here:</p> <p><a href="https://radar.hackthe.world" rel="noopener noreferrer">https://radar.hackthe.world</a></p> <blockquote> <p>Your website's url or security vulnerabilities are NOT displayed publicly. We only put the scores/averages publically.</p> </blockquote> <p>I am continuing to improve the scoring, reduce false positives, and learn which checks are most useful as the dataset grows.</p> webdev security showdev cybersecurity