PreFlight / website security checks
Website security checks
Security is a chain of small contracts: a browser must receive safe headers, a route must enforce access, a webhook must verify its sender, and a paid session must create the right entitlement. Explore the checks one contract at a time.
A route for the next question
Useful pages have a job to do.
Pick the page that matches the decision in front of you. Each brief explains the scope, the evidence to capture, the limits of automation, and the next action that makes the result useful.
Security Headers Check
security headers check: whether the browser receives the headers that reduce common client-side attack paths with a practical, evidence-led workflow for developers hardening a public web app.
Content-Security-Policy Check
Content-Security-Policy checker: whether the site limits where scripts, styles, frames, and connections can load from with a practical, evidence-led workflow for teams shipping JavaScript-heavy applications.
HSTS Check
HSTS checker: whether browsers are told to keep using HTTPS after the first secure visit with a practical, evidence-led workflow for site owners protecting HTTPS-only traffic.
X-Content-Type-Options Check
X-Content-Type-Options checker: whether content-type sniffing is disabled where it could turn an asset mistake into a security issue with a practical, evidence-led workflow for developers tightening browser parsing behavior.
Clickjacking Protection Check
clickjacking protection checker: whether another origin can embed a sensitive page and trick a user into clicking it with a practical, evidence-led workflow for teams protecting login, billing, and dashboard screens.
Referrer-Policy Check
Referrer-Policy checker: whether outbound requests receive only the amount of referrer context the product intends with a practical, evidence-led workflow for teams reducing accidental URL data leakage.
Permissions-Policy Check
Permissions-Policy checker: whether camera, microphone, geolocation, and other powerful features are restricted by default with a practical, evidence-led workflow for developers controlling browser capabilities.
CORS Configuration Check
CORS checker: whether cross-origin requests are allowed only for the origins and credentials the API expects with a practical, evidence-led workflow for API and frontend teams.
TLS Certificate Check
TLS certificate checker: whether the certificate chain, hostname, protocol, and expiry support a dependable secure connection with a practical, evidence-led workflow for site owners protecting HTTPS availability.
DNS Health Check
DNS health checker: whether DNS records and nameservers point visitors and providers to the intended surface with a practical, evidence-led workflow for operators responsible for a production domain.
Robots.txt Check
robots.txt checker: whether the crawler policy allows important pages and points bots to the correct sitemap with a practical, evidence-led workflow for site owners fixing crawler access.
XML Sitemap Check
XML sitemap checker: whether the sitemap lists canonical, reachable, useful URLs that a crawler can process with a practical, evidence-led workflow for content teams with growing site inventories.
Canonical URL Check
canonical URL checker: whether duplicate or parameterized URLs consolidate authority onto one preferred address with a practical, evidence-led workflow for teams managing multiple host and query variants.
Noindex Tag Check
noindex checker: whether a robots directive or response header is suppressing a page that should be searchable with a practical, evidence-led workflow for teams investigating why pages are missing from Google.
Open Graph Check
Open Graph checker: whether social crawlers receive an accurate title, description, image, type, and URL with a practical, evidence-led workflow for teams improving shared link previews.
JSON-LD Structured Data Check
JSON-LD checker: whether the page contains valid structured data that matches the visible content with a practical, evidence-led workflow for teams making product meaning explicit to crawlers.
FAQ Schema Check
FAQ schema checker: whether FAQ markup is used only where a real visible FAQ helps the reader understand the topic with a practical, evidence-led workflow for teams publishing answer-first pages.
Core Web Vitals Check
Core Web Vitals checker: whether loading, interaction, and visual stability create friction on important routes with a practical, evidence-led workflow for teams protecting the experience of real visitors.
Mobile-Friendly Check
mobile-friendly website checker: whether the page remains readable, tappable, and useful without horizontal scrolling with a practical, evidence-led workflow for teams serving visitors on small screens.
Exposed API Key Check
exposed API key scanner: whether a credential that should stay private appears in HTML, JavaScript, source maps, or public configuration with a practical, evidence-led workflow for developers shipping frontend bundles.
Source Map Exposure Check
source map security checker: whether production source maps reveal private source, environment details, or credential-bearing code with a practical, evidence-led workflow for teams deploying JavaScript applications.
Client Bundle Secret Scan
client-side secret scanner: whether a secret moved into code that every browser downloads with a practical, evidence-led workflow for AI-assisted builders and frontend teams.
Dependency Risk Check
website dependency scanner: whether a release depends on stale or vulnerable packages that need triage before promotion with a practical, evidence-led workflow for teams maintaining fast-moving JavaScript projects.
npm Audit Before Launch
npm audit before launch: whether dependency findings are understood in the context of the deployed application with a practical, evidence-led workflow for Node.js and Next.js teams.
XSS Surface Check
XSS scanner for websites: whether an input can become executable markup in a browser context with a practical, evidence-led workflow for teams rendering user or model-generated content.
SQL Injection Surface Check
SQL injection scanner: whether untrusted input can alter a database query or data access decision with a practical, evidence-led workflow for teams exposing search, filters, or database-backed APIs.
CSRF Protection Check
CSRF checker: whether another origin can cause a browser to submit a sensitive action without the user intending it with a practical, evidence-led workflow for teams with cookie-authenticated state changes.
Authentication Boundary Check
authentication security checker: whether protected behavior is actually protected at the route and data boundary with a practical, evidence-led workflow for teams with sign-in, onboarding, or account areas.
Rate Limiting Check
rate limit checker: whether abuse controls slow high-risk actions without blocking normal customers with a practical, evidence-led workflow for teams exposing login, API, or expensive automation routes.
Public API Endpoint Check
public API scanner: whether publicly reachable endpoints expose the intended contract and no more with a practical, evidence-led workflow for SaaS teams with browser and integration APIs.
Webhook Endpoint Check
webhook security checker: whether a webhook can be reached, verified, retried, and processed idempotently with a practical, evidence-led workflow for teams receiving payment or provider events.
Supabase RLS Check
Supabase RLS checker: whether Row Level Security enforces the ownership and tenant boundaries the application assumes with a practical, evidence-led workflow for builders protecting tenant data in Postgres.
Firebase Rules Check
Firebase security rules checker: whether client requests can read or write only the records and files the user is authorized to access with a practical, evidence-led workflow for teams using Firestore or Storage from a web client.
OAuth Redirect URI Check
OAuth redirect checker: whether login callbacks return to an approved origin without leaving an open redirect or broken environment mapping with a practical, evidence-led workflow for teams connecting GitHub, Google, or provider accounts.
Cookie Security Check
cookie security checker: whether session and preference cookies carry the flags that match their sensitivity and cross-site behavior with a practical, evidence-led workflow for teams using browser sessions.
Environment Variable Exposure Check
environment variable security scanner: whether a private runtime value was accidentally promoted to browser-visible configuration with a practical, evidence-led workflow for teams deploying through Vercel or another managed platform.
Vercel Deployment Check
Vercel deployment checker: whether the production deployment, domains, environment variables, and release state agree with a practical, evidence-led workflow for teams shipping Next.js on Vercel.
Stripe Checkout Check
Stripe checkout checker: whether a test-mode payment travels from checkout through a signed webhook to the entitlement a customer receives with a practical, evidence-led workflow for SaaS teams charging for access.
Uptime Check
uptime checker: whether an important public endpoint responds with the behavior customers expect with a practical, evidence-led workflow for operators who need dependable availability evidence.
Website Accessibility Check
website accessibility checker: whether the public interface exposes common barriers that make navigation or understanding harder with a practical, evidence-led workflow for teams serving a broad customer base.
Email Authentication Check
SPF DKIM DMARC checker: whether domain authentication and sender signals support reliable delivery and reduce spoofing risk with a practical, evidence-led workflow for SaaS teams sending transactional email.
Title and Meta Description Check
meta title and description checker: whether the page title and description explain the real page intent in the places searchers first see with a practical, evidence-led workflow for content and product marketing teams.
Heading Hierarchy Check
heading hierarchy checker: whether the document structure makes the main answer and supporting questions clear to people and crawlers with a practical, evidence-led workflow for developers and editorial teams.
Internal Link Check
internal link checker: whether important pages are reachable through descriptive links from relevant hubs with a practical, evidence-led workflow for teams growing a documentation or content library.
Orphan Page Check
orphan page finder: whether a published page exists in the sitemap but has no useful path from the site hierarchy with a practical, evidence-led workflow for SEO operators managing large sites.
Redirect Chain Check
redirect chain checker: whether a visitor or crawler reaches the canonical page without unnecessary redirect hops with a practical, evidence-led workflow for teams migrating domains or routes.
Soft 404 Check
soft 404 checker: whether an unavailable or empty page returns a misleading success response with a practical, evidence-led workflow for content teams with retired or thin routes.
JavaScript Rendering Check
JavaScript SEO checker: whether important copy and links exist in the rendered HTML available to crawlers with a practical, evidence-led workflow for teams shipping client-rendered applications.
Server-Rendered Content Check
server rendered content checker: whether the page publishes its answer in the initial response instead of waiting for a fragile client request with a practical, evidence-led workflow for Next.js and React teams.
Image Alt Text Check
image alt text checker: whether meaningful images have concise alternative text and decorative images are marked appropriately with a practical, evidence-led workflow for content and frontend teams.
security.txt Check
security.txt checker: whether a researcher can find a clear, current route for reporting a vulnerability with a practical, evidence-led workflow for security-conscious site owners.
Privacy Signal Check
website privacy compliance checker: whether the public site makes its data collection, cookies, and contact choices understandable with a practical, evidence-led workflow for SaaS and marketing teams.
Access Control Check
access control security checker: whether authorization decisions happen at the resource boundary rather than only in the interface with a practical, evidence-led workflow for teams protecting tenant and admin features.
Session Management Check
session security checker: whether session creation, rotation, expiry, and revocation match the sensitivity of the product with a practical, evidence-led workflow for teams with account sessions.
Password Reset Check
password reset security checker: whether reset links expire, resist enumeration, and never grant more access than intended with a practical, evidence-led workflow for teams operating authentication flows.
Login Enumeration Check
login enumeration checker: whether login and recovery responses reveal which email addresses or usernames exist with a practical, evidence-led workflow for teams protecting account privacy.
API Error Disclosure Check
API error security checker: whether failures help a legitimate developer without exposing stack traces, secrets, or internal topology with a practical, evidence-led workflow for teams maintaining public JSON APIs.
Dependency License Check
dependency license checker: whether package choices have a known license or policy conflict before a commercial release with a practical, evidence-led workflow for product teams shipping third-party code.
Backup Freshness Check
backup freshness checker: whether the recovery copy is recent enough for the business impact of a failure with a practical, evidence-led workflow for operators responsible for customer data.
Status Page Check
status page checker: whether the status page is reachable, current, and scoped to the service customers actually use with a practical, evidence-led workflow for teams communicating incidents publicly.
Deployment Rollback Check
deployment rollback readiness checker: whether the team can return to a known-good release without guessing during an incident with a practical, evidence-led workflow for teams shipping frequent releases.
Start outside-in
Find the issue. Prove the fix.
Run the free public audit before you connect providers. PreFlight shows the visible risk first, then helps you verify the workflows scanners cannot reach.