Simple Website Security Checker

A beginner-friendly Python tool that performs defensive, non-exploitative checks on a website’s publicly visible configuration.

It looks for common hardening gaps such as:

• Whether HTTP redirects to HTTPS
• Missing security headers (HSTS, CSP, etc.)
• Weak cookie flags (Secure, HttpOnly, SameSite)
• Basic TLS certificate status (expired / expiring soon)

This is not a penetration testing suite. It does not send attack payloads, exploit vulnerabilities, or brute-force anything.

How to test without your own website

Use the included local practice server. It runs only on your computer.

Terminal 1 — start the demo (weak mode):

python demo_server.py

Terminal 2 — scan it:

python check_site.py http://127.0.0.1:8765

Then restart the demo with stronger headers and compare:

python demo_server.py --mode hardened
python check_site.py http://127.0.0.1:8765

You should see fewer “Could improve” items in hardened mode.

example.com is also fine for a quick smoke test (it is reserved for documentation), but the local demo is the best learning path.

Legal / ethical use

Best practice: scan sites you own or have permission to test.

What this tool does is intentionally light: it fetches a public page (like a browser) and reads response headers plus basic TLS certificate info. It does not log in, pull private data, or try exploits.

A single learning run against a public homepage is similar to visiting the site. Still avoid hammering popular sites, don’t automate scans against them, and prefer the local demo when you can.

Setup

python -m venv .venv
# Windows:
.venv\Scripts\activate
# macOS/Linux:
source .venv/bin/activate
pip install -r requirements.txt

Usage

python check_site.py http://127.0.0.1:8765
python check_site.py https://example.com

Options:

python check_site.py example.com --timeout 15
python check_site.py https://example.com --no-http-probe

The report is grouped into calm sections:

Section	Meaning
Looks good	Sensible configuration
Could improve	Optional hardening suggestions (not “you’re hacked”)
Worth knowing	Informational notes

Learning next steps

1. Compare demo_server.py --mode weak vs --mode hardened
2. Read what each security header does
3. Use browser DevTools → Network to inspect the same headers yourself
4. Later, try authorized lab apps you run locally (still defensive learning)

Do not jump into exploitation tooling until you have a legal lab environment and clear permission.