Why 60% of production apps fail defensive security audits, and how to test HSTS, CSP, and DNS records with 1 line of terminal code.

We spend countless hours tweaking unit tests, Docker builds, and database indexes. Yet, one of the easiest attack vectors is also the one most teams forget: HTTP defensive security headers.
Without strict headers, your app can leave users exposed to:

• SSL-Stripping / MitM (missing Strict-Transport-Security with preload)
• Clickjacking & iFrame hijacking (missing X-Frame-Options)
• XSS & malicious script injection (missing Content-Security-Policy)
• Domain spoofing & phishing (unconfigured DNS SPF/DMARC)

To solve this for my own deployment pipelines without dealing with slow web UIs or enterprise sales walls, I built SiteScanAPI
— a passive, edge-powered scanner and zero-auth REST API that audits any domain in under 250 milliseconds.

---

🛠️ The Problem with Existing Scanners

Most security checkers out there fall into one of two camps:

1. Interactive-only web tools with no clean, programmatic REST API for automated CI/CD checks.
2. Heavy vulnerability suites that require accounts, API keys, credit cards, or run intrusive network probing that can trigger firewall bans.

I wanted something lightweight, passive, and instantaneous that could be queried from curl, GitHub Actions, or a monitoring cron job.

---

⚡ How It Works Under the Hood

The engine runs on globally distributed edge workers (Cloudflare Edge). When an audit request comes in:

1. Non-Intrusive HTTP Interrogation: Sends standard passive GET/HEAD requests to inspect returned headers without testing invasive payloads.
2. Strict RFC & W3C Analysis: Evaluates HSTS max-age, CSP directives, Referrer-Policy, and Permissions-Policy against current standards.
3. Next-Gen Origin Isolation: Checks modern browser boundaries like Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP).
4. Parallel DNS-over-HTTPS (DoH): Resolves and audits SPF and DMARC records to flag email spoofing risks.
5. Vulnerability Disclosure (RFC 9116): Confirms whether /.well-known/security.txt exists for white-hat reports.
6. Information Leak Scrape: Flags banner disclosures like Server: Apache/2.4.41 or X-Powered-By: Express.

💻 Try It in 1 Line of Code
No API keys, no registration. Open your terminal:

curl -s "https://sitescanapi.com/api/scan?url=github.com" | jq

Example JSON Response

{
  "target": "github.com",
  "score": 95,
  "grade": "A+",
  "summary": {
    "passed": 11,
    "warnings": 1,
    "failed": 0
  },
  "checks": [
    {
      "name": "Strict-Transport-Security",
      "header": "strict-transport-security",
      "present": true,
      "status": "pass",
      "value": "max-age=31536000; includeSubDomains; preload",
      "recommendation": "Enforces HTTPS connections and preloading."
    },
    {
      "name": "Content-Security-Policy",
      "header": "content-security-policy",
      "present": true,
      "status": "pass"
    }
  ],
  "dns": {
    "spf": { "present": true, "status": "pass" },
    "dmarc": { "present": true, "status": "pass" }
  }
}

---

🤖 Automate It in GitHub Actions

You can drop this step into your CI/CD workflow to fail builds if someone pushes a change that degrades your production security posture:

name: Security Perimeter Audit

on:
  deployment_status:

jobs:
  audit-headers:
    if: github.event.deployment_status.state == 'success'
    runs-on: ubuntu-latest
    steps:
      - name: Audit Production Security Score
        run: |
          DOMAIN="yourdomain.com"
          RESPONSE=$(curl -s "https://sitescanapi.com/api/scan?url=${DOMAIN}")
          SCORE=$(echo "$RESPONSE" | jq -r '.score')
          GRADE=$(echo "$RESPONSE" | jq -r '.grade')

          echo "Perimeter Security Grade: $GRADE ($SCORE/100)"

          if [ "$SCORE" -lt 80 ]; then
            echo "❌ Security score below minimum threshold (80). Check missing headers!"
            exit 1
          fi
          echo "✅ Security headers check passed!"

---

🔧 2-Minute Quick Fixes

If your site scores below an A, here are the most impactful fixes:

Nginx

# Add to your server block
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Strip server banner disclosure
server_tokens off;

Cloudflare (_headers file)

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

---

🚀 Test Your Domain

You can test any domain live using the web interface or directly via the API:

• 🌐 Web Dashboard: sitescanapi.com
• 📡 API Endpoint: https://sitescanapi.com/api/scan?url={domain}

---

💬 Discussion

What score did your production domain get? What has been your biggest headache when implementing a strict Content Security Policy (CSP)? Drop your domain or thoughts in the comments below!