OWASP Security Checkup
Checks the OWASP Secure Headers list and the externally visible OWASP Top 10:2025 items (A02, A03, A04). No crawling or injection testing. Free, no sign-up.
Detected
Scope of this check — honest disclosure
DechoNet only checks what is externally observable: public HTTP responses and TLS/certificates. For a domain owner verified by DNS TXT record, it also requests twelve well-known paths that must never be public (.env, .git, server-status, phpinfo …). The OWASP Top 10 categories below require authenticated access, active crawling or injection testing and are out of scope here. Note they are not marked "pass" — that means not observable, not a safety guarantee.
Not observable (requires separate active testing)
These cannot be seen from the outside, but you can self-assess them as follows:
- A01 Broken Access Control (including SSRF) — Attempt to reach out-of-scope resources with an authenticated session (manual testing or OWASP ZAP); for SSRF (now part of A01), review server-side request handling.
- A05 Injection — Inject SQL / command / XSS payloads into inputs (ZAP, sqlmap — only on apps you own).
- A06 Insecure Design — Verify via threat modeling and design review — cannot be confirmed by an automated scan.
- A07 Authentication Failures — Review login, session management, MFA, and password policy in an authenticated context.
- A08 Software or Data Integrity Failures — Review the CI/CD pipeline, dependency signing, and update integrity. The front page's third-party scripts are shown below for reference, not graded.
- A09 Security Logging and Alerting Failures — Review log collection, alerting, and monitoring internally.
- A10 Mishandling of Exceptional Conditions — Check that errors fail closed and reveal nothing: force timeouts, malformed input and dependency failures in a test environment and review what the app does and shows.
Pro Watch this posture every day
A one-time check shows only this moment. Regressions — a header dropped, TLS downgraded, a certificate drifting toward expiry — only surface over time. A watch re-checks this domain daily and records each change on a watch page.
Start watching this domain →Related Guides
What is the OWASP Security Checkup
It checks the OWASP Secure Headers Project and the externally observable subset of the OWASP Top 10 (2025) in a single lookup. We collect the target domain's public HTTP response headers and TLS/certificate, map them onto A04 (Cryptographic Failures), A02 (Security Misconfiguration) and A03 (Software Supply Chain Failures — outdated components exposed) plus secure-header status, and return a grade with findings.
How it works and its scope
Two observations run in parallel — an HTTP response-header trace and a TLS/CT-log lookup — and the results map onto OWASP Top 10 (2025) categories. If you have verified the domain with a DNS TXT record (the same one the exposed admin page check uses), it also sends one GET each to five paths that must never be public (/.env, /.env.production, /.git/config, /.git/HEAD, /server-status); a hit counts only if the content matches the expected signature, so a custom error page served with status 200 does not trigger it. There is no crawling, password guessing or injection testing, so categories that need active testing — A01 (Access Control), A05 (Injection), A07 (Authentication) — cannot be checked, and the results say so.
FAQ
Does this check the full OWASP Top 10?
No. It checks only the externally observable subset (Secure Headers, A02, A03, A04 of the 2025 list) without authentication or active testing. A01/A05/A06/A07/A08/A09/A10 are marked not observable. A full Top 10 assessment requires an active scanner like OWASP ZAP or a penetration test.
Does this check harm the target site?
It sends what a browser would — a public HTTP GET and a TLS connection — plus a public CT-log lookup. It does not inject payloads, guess passwords or crawl. Requests for sensitive files (.env, .git, server-status) are made only after the domain owner verifies with a DNS TXT record, so checking someone else's domain never touches those paths.
How do I know when the result changes?
A one-time check shows only the current moment. Start a watch and DechoNet re-checks the domain daily and records regressions — a dropped header, a TLS downgrade, an approaching certificate expiry — on the watch page.