I recently launched RADAR, a free website security scanner.
It has now run 94 scans across 68 distinct websites.
The part I was not ready for:
- 38 scan results received an F
- The median score is only 53/100
- F is currently the largest grade category by far 38 of 94 scans, or 40.4%, resulted in an F. That F count is equivalent to 55.9% of the 68 distinct websites scanned.
The websites did not look broken
Most of the sites looked finished and worked normally. In fact, they had a pretty nice UI too.
That is what makes the results interesting. A website can load correctly, have a polished interface, and appear production-ready while still missing basic security.
The problems Radar commonly looks for include:
- Missing or weak Content Security Policy
- Missing clickjacking protection
- Missing HSTS
- Insecure cookie configuration
- Dangerous CORS settings
- Mixed HTTP and HTTPS content
- Missing Subresource Integrity
- Exposed server or framework information
- Unsafe redirects
- Publicly exposed files or information
The visible product may be complete while its security configuration was simply never reviewed.
Why I built Radar
Before building Radar, I used to check websites shared by builders in the Lovable Discord server with RADAR when it was an internal tool I had made.
I kept seeing the same protections missing:
- Content Security Policy
- Anti-framing protection through
frame-ancestorsorX-Frame-Options - Permissions Policy
Some owners asked me to scan more of their projects because they had no easy way to check these things themselves.
That eventually pushed me to turn the internal scanner into a public tool.
What Radar actually measures
Radar analyzes security information that is publicly observable from a deployed website.
It checks areas such as:
- HTTPS and redirect behavior
- Security headers
- CSP strength
- Cookies
- CORS
- Mixed content
- External scripts and styles
- Technology and hosting fingerprints
- Exposed information
It then produces a readable report with a score and a grade from F to S+.
There is no login or payment required for a basic scan.
The score represents the website’s publicly visible security configuration. It is meant to identify overlooked protections and provide a useful starting point, not replace a full security audit.
The statistics are live
The dataset is still early, and the numbers will change as more websites are scanned.
The live aggregate statistics are available here:
https://radar.hackthe.world/stats
You can scan your own website here:
Your website's url or security vulnerabilities are NOT displayed publicly. We only put the scores/averages publically.
I am continuing to improve the scoring, reduce false positives, and learn which checks are most useful as the dataset grows.
Top comments (0)