Understand your website security tests

Communication Security

Cookie Security Check

This test verifies that your site's cookies are protected by the following security flags: Secure (transmitted only over HTTPS), HttpOnly (inaccessible via JavaScript), and SameSite (restricted to same‑site requests). These flags prevent session hijacking and XSS attacks.

Read article → Communication Security

HttpOnly Flag on Joomla Session Cookies Check

This test checks whether Joomla session cookies are protected by the HttpOnly flag. This flag prevents cookie access via JavaScript, protecting against XSS attacks that aim to steal user sessions. Without it, an attacker can intercept session cookies and impersonate logged‑in users, including administrators.

Read article → Communication Security

Shopify HTTPS Redirect Check

This test checks whether your Shopify store automatically redirects all HTTP requests to HTTPS. Shopify provides HTTPS by default, but automatic redirection is essential to ensure all communications are encrypted. Lack of redirection can expose customer data (passwords, payment information) on first connection.

Read article → Communication Security

SSL Certificate Check

This test checks that your SSL certificate is valid, not expired, and that the server responds correctly on port 443 (HTTPS). An SSL certificate is essential to encrypt exchanges between your visitors and your server, and to avoid security warnings in browsers.

Read article → Communication Security

Shopify SSL/TLS Configuration Check

This test checks the SSL/TLS configuration of your Shopify store. A weak configuration (e.g., obsolete TLS protocols, weak cipher suites) can expose customer data (payment information, passwords) during transactions. A robust configuration is essential for communication security.

Read article → Communication Security

Known CVE Vulnerability Check on Used Technologies

This test analyses your site's HTTP headers to identify versions of technologies used (PHP, web server, CMS). If a version is detected, it is compared against a database of known vulnerabilities (CVE). An outdated or vulnerable version can expose your site to automated attacks exploiting public flaws.

Read article → Communication Security

HSTS Header Check (HTTP Strict Transport Security)

This test checks for the presence of the HTTP Strict-Transport-Security (HSTS) header. This header forces browsers to connect exclusively over HTTPS, even if the user enters an HTTP URL. It protects against downgrade attacks and connection hijacking.

Read article →

Legal Compliance

CNIL Mention in Privacy Policy Check

This test checks whether your privacy policy mentions the CNIL (French Data Protection Authority) or another data protection authority (e.g., ICO in the UK). This mention shows seriousness and GDPR compliance. It informs users that they can contact this authority in case of disputes or rights violations.

Read article → Legal Compliance

Cookie Consent Banner Presence Check

This test checks whether your site displays a cookie consent banner. Under the GDPR and ePrivacy Directive, any site using non‑essential cookies must inform users and obtain explicit consent before placing such cookies. The absence of a banner exposes you to fines and harms user trust.

Read article → Legal Compliance

Shopify Terms and Conditions (T&C) Presence Check

This test checks whether your Shopify store has a Terms and Conditions page accessible to the public. T&C are mandatory for any e‑commerce activity and must detail sales terms, delivery, returns, and refunds. Their absence exposes you to legal risks and can harm customer trust.

Read article → Legal Compliance

Shopify Cookie Consent Banner Presence Check

This test checks whether your Shopify store displays a cookie consent banner. Under the GDPR and ePrivacy Directive, any site using non‑essential cookies must inform users and obtain explicit consent. Shopify offers apps or built‑in settings to add this banner. Its absence exposes you to fines and harms user trust.

Read article → Legal Compliance

Privacy Policy Page Presence Check

This test checks for the presence of a privacy policy page accessible on your site. This page is required by the GDPR in Europe, the CCPA in California, and many other data protection laws. It details how you collect, use, store, and protect visitor data. Its absence exposes you to fines and loss of trust.

Read article → Legal Compliance

Cookie Policy Page Presence Check

This test checks for the presence of a cookie policy page on your site. Under regulations (GDPR, ePrivacy), any site using cookies must inform users about their presence, purpose, and allow them to refuse them. This page must detail each type of cookie used (technical, statistical, advertising).

Read article →

Form Security

CAPTCHA Presence on Client Login Page Check

This test checks for the presence of a CAPTCHA on the client login form (front‑office). Without this protection, your customers' accounts are exposed to brute‑force attacks, where scripts try thousands of combinations to take over accounts. This can lead to data theft, fraudulent purchases, and loss of trust.

Read article → Form Security

Shopify Admin CAPTCHA Protection Check

This test checks whether the Shopify admin login page is protected by a CAPTCHA. Shopify includes security mechanisms, but adding a CAPTCHA reinforces protection against brute‑force and automated login attempts. Lack of CAPTCHA can expose admin accounts to compromise risks.

Read article → Form Security

CAPTCHA Presence on Password Reset Form Check

This test checks whether your password reset form is protected by a CAPTCHA. Without it, attackers can automate reset requests to harass your users, saturate your email system, or attempt to take over accounts by exploiting potential weaknesses in the reset process.

Read article → Form Security

Shopify Contact Form CAPTCHA Protection Check

This test checks whether your Shopify contact form is protected by a CAPTCHA. Without it, your form can be flooded with automated messages (spam, phishing, ads), polluting your inbox, harming your reputation, and enabling form injection attacks.

Read article → Form Security

Shopify File Upload Security Check

This test checks the security of file uploads on your Shopify store (e.g., product images, customer downloads). Insufficient validations can allow attackers to upload malicious files, execute scripts, or compromise your site.

Read article → Form Security

CAPTCHA Presence on Public Forms Check

This test checks whether your public forms (contact, login, registration, password reset) use a CAPTCHA (reCAPTCHA, hCaptcha, Turnstile). The absence of CAPTCHA exposes your site to automated submissions, spam, and brute‑force attacks, which can degrade performance and compromise security.

Read article → Form Security

Shopify Client Login CAPTCHA Protection Check

This test checks whether your Shopify store's client login page is protected by a CAPTCHA. Without it, customer accounts are exposed to brute‑force attacks, where scripts try thousands of combinations to take over accounts. This can lead to fraudulent purchases, data theft, and loss of trust.

Read article → Form Security

CAPTCHA Presence on Admin Page Check

This test checks for the presence of a CAPTCHA on your site's administration interface (usually /admin, /administrator, /wp-admin). The admin area is a prime target for brute‑force attacks. A CAPTCHA adds an extra barrier against automated access attempts.

Read article → Form Security

CAPTCHA Presence on Registration Page Check

This test checks whether your registration form is protected by a CAPTCHA. Automated registration via bots can create hundreds of fake accounts, overload your database, skew your statistics, and sometimes impersonate identities. Without CAPTCHA, your system is vulnerable to these attacks.

Read article → Form Security

Shopify CSRF Protection Check

This test checks for the presence of CSRF tokens in forms and requests on your Shopify store. Insufficient CSRF protection can allow attackers to perform unauthorised actions (e.g., account modifications, purchases) using an authenticated user's session.

Read article → Form Security

CAPTCHA Presence on Contact Form Check

This test checks whether your contact form is protected by a CAPTCHA. Without it, your form can be flooded with automated messages (spam, phishing, ads), polluting your inbox, harming your reputation, and even enabling form injection attacks.

Read article → Form Security

Shopify Registration CAPTCHA Protection Check

This test checks whether your Shopify client registration page is protected by a CAPTCHA. Automated registration via bots can create hundreds of fake accounts, overload your database, skew statistics, and sometimes impersonate identities. This can also lead to abuse of loyalty systems or promotional offers.

Read article → Form Security

Shopify SQL Injection Protection Check

This test checks whether your Shopify store is vulnerable to SQL injection attacks. Shopify generally secures queries via its APIs, but misconfiguration or a third‑party app can create gaps. A successful SQL injection can expose sensitive data (orders, customers, payment information) and compromise your business.

Read article → Form Security

Malicious File Presence Check in Upload Folders

This test searches for potentially malicious files (shell.php, cmd.php, webshell.php, backdoor.php, etc.) in upload folders. Such files often allow an attacker to execute commands on your server, modify files, or steal data. Their presence is critical and requires immediate action.

Read article → Form Security

Login Attempt Limiting Check

This test detects whether login attempt limiting (rate limiting) mechanisms are active on your authentication forms. The absence of protection exposes your accounts to brute‑force attacks, where scripts try thousands of password combinations to take over an account.

Read article → Form Security

Two-Factor Authentication (2FA) Check

This test looks for indicators of two-factor authentication (2FA) presence on your site, whether via mentions in HTML code, dedicated forms, or specific plugins. 2FA is an indispensable protection against unauthorised access, even if a password is compromised.

Read article → Form Security

Shopify Password Reset CAPTCHA Protection Check

This test checks whether your Shopify password reset page is protected by a CAPTCHA. Without it, attackers can automate reset requests to harass your customers, saturate your email system, or attempt account takeover by exploiting weaknesses in the reset process.

Read article →

Server Configuration

Drupal Upload Folder Indexing Check (sites/default/files/)

This test checks whether the Drupal upload folder (sites/default/files/) is accessible and whether indexing is enabled. An unprotected folder allows any visitor to list all uploaded files, including images, documents, and sometimes sensitive files, exposing your data.

Read article → Server Configuration

PHP Error Display on WordPress Check

This test checks whether PHP errors are displayed publicly on your WordPress site. WordPress can display PHP errors if WP_DEBUG_DISPLAY is enabled in wp-config.php. Error display reveals sensitive information like file paths, PHP versions, SQL queries, and sometimes credentials. This data facilitates exploitation of vulnerabilities.

Read article → Server Configuration

Shopify Upload Folder Security Check

This test checks whether Shopify upload folders (like /uploads/, /files/) are properly secured. Unsecured folders can expose sensitive files (images, documents) to public access, compromising the confidentiality of customer data.

Read article → Server Configuration

WordPress Uploads Folder Protection Check (.htaccess, index.html files)

This test checks for the presence of protection files (like .htaccess and index.html) in the WordPress upload folder (wp-content/uploads/). A .htaccess file with 'Deny from all' blocks direct access to files, while an empty index.html prevents content listing. Lack of these protections exposes your files to public access.

Read article → Server Configuration

Upload Folder Protection Check (.htaccess, index.html files)

This test checks whether upload folders contain protection files like .htaccess (to block direct access or script execution) or index.html (to hide folder contents). Lack of these protections exposes your uploaded files to public access, which can allow sensitive file downloads or malicious script execution.

Read article → Server Configuration

Directory Indexing Check

This test checks whether directory indexing is enabled on your server. When enabled, visitors can see the full list of files in a folder (e.g., /uploads/) and directly access sensitive files (backups, documents, scripts). This constitutes a critical information leak.

Read article → Server Configuration

WordPress Upload Folder Indexing Check (wp-content/uploads/)

This test checks whether the WordPress upload folder (wp-content/uploads/) is accessible and whether indexing is enabled. An unprotected folder allows any visitor to list all uploaded files, including confidential documents, photos, invoices, or malicious files. This constitutes a critical information leak.

Read article → Server Configuration

Server Configuration Information Check

This test checks whether sensitive server configuration information is exposed via HTTP headers (Server, X-Powered-By, X-Generator). These headers reveal versions of your web server, PHP, or CMS, allowing attackers to identify known vulnerabilities and exploit them.

Read article → Server Configuration

Server Status Pages Access Check

This test checks whether your server status pages (Apache /server-status, Nginx /nginx_status) are publicly accessible. These pages display detailed information about current requests, connections, processes, and sometimes visitor IP addresses. Their exposure can help an attacker understand your server architecture, detect weak points, or launch denial‑of‑service attacks.

Read article → Server Configuration

Shopify phpinfo Exposure Check

This test checks whether the phpinfo file is publicly accessible on your Shopify store. phpinfo() displays details about your PHP configuration (version, extensions, paths, environment variables), which can help an attacker prepare targeted attacks. Its exposure is a critical information leak.

Read article → Server Configuration

Joomla Upload Folder Indexing Check (images/)

This test checks whether the Joomla upload folder (usually /images/) is accessible and whether indexing is enabled. An unprotected folder allows any visitor to list all uploaded files, including photos, documents, and sometimes sensitive files.

Read article → Server Configuration

PHP Error Display on Drupal Check

This test checks whether PHP errors are displayed publicly on your Drupal site. Displaying errors in production reveals information like file paths, PHP versions, SQL queries, and sometimes credentials. This data facilitates targeted attacks and compromises your site's security.

Read article → Server Configuration

Upload Folder Indexing Check

This test checks whether upload folders (like /uploads/, /media/, /files/) are accessible and whether indexing is enabled. When enabled, any visitor can list all files hosted in these folders, including confidential documents, photos, invoices, or malicious files.

Read article → Server Configuration

PHP Error Display on Magento Check

This test checks whether PHP errors are displayed publicly on your Magento store. Displaying errors in production reveals information like file paths, PHP versions, SQL queries, and sometimes credentials. This data facilitates targeted attacks and compromises your e‑commerce store security.

Read article → Server Configuration

Shopify Error Display Check

This test checks whether error display is enabled in production on your Shopify store. Error messages can reveal information about your server configuration, file paths, or SQL queries. Their exposure facilitates targeted attacks.

Read article → Server Configuration

PrestaShop Upload Folder Indexing Check

This test checks whether PrestaShop upload folders (like /upload/, /img/, /images/, /files/) are accessible and whether indexing is enabled. An unprotected folder allows any visitor to list all uploaded files, including product images, sensitive documents, invoices, or malicious files.

Read article → Server Configuration

PHP Error Display in Production Check

This test checks whether PHP errors (Fatal error, Parse error, Warning, Notice, Deprecated, Uncaught Error, Exception) are displayed publicly on your site. Displaying errors in production exposes sensitive information about code structure, file paths, PHP versions, and sometimes database credentials. This data facilitates targeted attacks.

Read article → Server Configuration

Database Administration Tools Access Check

This test checks whether database administration tools like phpMyAdmin, Adminer, phpPgAdmin, or others are publicly accessible. These tools provide a graphical interface for managing your databases. Their exposure without strong authentication is critical: an attacker can access all your data, modify it, delete it, or even take control of your server.

Read article → Server Configuration

PHP Error Display on Joomla Check

This test checks whether PHP errors are displayed publicly on your Joomla site. Displaying errors in production reveals information like file paths, PHP versions, SQL queries, and sometimes credentials. This data facilitates targeted attacks and compromises your site's security.

Read article → Server Configuration

Index File Presence in Upload Folders Check

This test checks whether upload folders (like /uploads/, /media/, /files/, /images/) contain an index.html or index.php file. These files block content listing when directory indexing is disabled. Their absence can expose all hosted files, even if indexing is disabled (since some servers may display a 403 or 404 error page that may reveal information).

Read article → Server Configuration

PHP Error Display on PrestaShop Check

This test checks whether PHP errors are displayed publicly on your PrestaShop site. Displaying errors in production reveals information like file paths, PHP versions, SQL queries, and sometimes credentials. This data facilitates targeted attacks and compromises your store security.

Read article →

Data Exposure

Email Address Exposure Check

This test checks whether email addresses are publicly exposed in your site's HTML code. Spam bots harvest these addresses to send unsolicited messages. Moreover, exposed addresses can be used for phishing or identity theft. Even if emails are displayed on the page, their plaintext presence in the HTML makes them vulnerable.

Read article → Data Exposure

SQL Query Exposure Check

This test checks whether SQL queries or database connection information are exposed in your site's HTML code. Accidental exposure can reveal your database structure, credentials, or allow an attacker to prepare an SQL injection. This risk is critical as it exposes the integrity of your data.

Read article → Data Exposure

Plaintext Password Exposure Check

This test detects whether plaintext passwords (or suspicious strings) appear in your site's HTML code, whether in comments, data attributes, JavaScript variables, or visible text. Accidental exposure can reveal test credentials, temporary passwords, or even API keys. Such leaks can compromise the integrity of your site and users.

Read article → Data Exposure

Shopify Environment Information Exposure Check

This test checks whether sensitive environment variables are publicly exposed on your Shopify store (e.g., via .env or logs). This information may include API keys, database credentials, or critical configuration settings. Their exposure can compromise your site security.

Read article → Data Exposure

Magento Git File Exposure Check

This test checks whether Git files (like .git/HEAD) are publicly accessible on your Magento site. Exposure of these files allows an attacker to retrieve your source code, secrets, and development history, compromising your site integrity.

Read article → Data Exposure

Shopify API Key Exposure Check

This test checks whether Shopify API keys (like SHOPIFY_API_KEY, SHOPIFY_ACCESS_TOKEN) are publicly exposed in your store's HTML code. API keys allow access to third‑party services and sensitive data. Their exposure can lead to abuse, data theft, or fraud.

Read article → Data Exposure

API Key Exposure Check

This test checks whether API keys, tokens, or secrets are publicly exposed in your site's HTML code. API keys grant access to third‑party services (payment, databases, messaging, etc.). Their exposure can lead to abuse, data theft, or fraud.

Read article →

Sensitive Files

Development File Exposure Check

This test checks whether sensitive development or configuration files are publicly accessible, such as .env.example, phpinfo.php, composer.json, package.json, etc. These files reveal information about your environment, dependencies, versions, and sometimes test credentials, making attackers' jobs easier.

Read article → Sensitive Files

wp-config.php File Access Check

This test checks whether the wp-config.php file is publicly accessible. This file contains WordPress database connection credentials, security keys, and configuration settings. Its exposure allows an attacker to take full control of your site, steal data, or inject malware.

Read article → Sensitive Files

WordPress Debug Log Exposure Check

This test checks whether the WordPress debug log file (debug.log) is publicly accessible. This file contains detailed information about errors, warnings, and SQL queries executed on your site. Its exposure can reveal database structure, credentials, or file paths, making attacks easier.

Read article → Sensitive Files

PrestaShop Log File Exposure Check

This test checks whether PrestaShop log files (in /log/, /logs/, /cache/logs/, /var/logs/) are publicly accessible. These logs contain detailed information about errors, admin accesses, SQL queries, and sometimes personal data or intrusion attempts. Their exposure can facilitate targeted attacks or information theft.

Read article → Sensitive Files

.htaccess File Presence and Security Check

This test checks for the presence of the .htaccess file in your site root and evaluates its basic configuration. The .htaccess file allows you to define security rules for Apache, such as protecting sensitive files, disabling indexing, managing redirects, and blocking malicious IP addresses.

Read article → Sensitive Files

Shopify Sensitive File Exposure Check

This test checks whether sensitive Shopify files (config/settings_data.json, .shopify, config.yml, shopify.yml) are publicly accessible. These files may contain configuration settings, credentials, or information about your store. Their exposure can compromise your e‑commerce site security.

Read article → Sensitive Files

PrestaShop parameters.php File Access Check

This test checks whether the PrestaShop configuration file (parameters.php) is publicly accessible. This file contains database connection credentials, security settings, and encryption keys for your store. Its exposure allows an attacker to steal customer data, orders, and take full control of your e‑commerce site.

Read article → Sensitive Files

Drupal Temporary Folder (tmp/) Access Check

This test checks whether the Drupal temporary folder is publicly accessible. This folder may contain temporary files, sessions, and data being processed. Its exposure can reveal information about your site's architecture.

Read article → Sensitive Files

PrestaShop Backup File Exposure Check

This test checks whether PrestaShop backup files (backup.sql, backup.zip, backup.tar, backup.gz, etc.) are publicly accessible. These files contain your entire database, files, and sometimes credentials. Their exposure allows an attacker to steal all your customer data, orders, products, and compromise your e‑commerce activity.

Read article → Sensitive Files

Shopify Backup File Exposure Check

This test checks whether Shopify backup files (backup.sql, backup.zip, etc.) are publicly accessible. These files contain sensitive data like products, orders, and customer information. Their exposure can compromise your business and customer privacy.

Read article → Sensitive Files

Joomla Temporary Folder (/tmp/) Access Check

This test checks whether the Joomla temporary folder (/tmp/) is publicly accessible. This folder may contain temporary files, sessions, cache files, or data being processed. Its exposure can reveal information about your site's architecture or confidential data.

Read article → Sensitive Files

Joomla Log File Exposure Check

This test checks whether Joomla log files (e.g., in /logs/ or /administrator/logs/) are publicly accessible. These logs contain detailed information about errors, admin accesses, SQL queries, and sometimes personal data or intrusion attempts. Their exposure can facilitate targeted attacks or information theft.

Read article → Sensitive Files

Joomla configuration.php File Access Check

This test checks whether the Joomla configuration file (configuration.php) is publicly accessible. This file contains database connection credentials, security settings, and encryption keys for your Joomla site. Its exposure allows an attacker to steal your data, modify configuration, or take full control of your site.

Read article → Sensitive Files

Magento Configuration File Exposure Check

This test checks whether Magento configuration files (env.php, config.php, etc.) are publicly accessible. These files contain database credentials, encryption keys, and security settings. Their exposure allows an attacker to steal your data and take control of your e‑commerce store.

Read article → Sensitive Files

Magento Log File Exposure Check

This test checks whether Magento log files (in var/log/) are publicly accessible. Their exposure can facilitate targeted attacks or information theft.

Read article → Sensitive Files

Joomla Backup File Exposure Check

This test checks whether Joomla backup files (backup.sql, backup.zip, backup.tar, backup.gz, etc.) are publicly accessible. These files contain your entire database, files, and sometimes credentials. Their exposure allows an attacker to steal all your data, copy your site, or destroy it.

Read article → Sensitive Files

Magento Backup File Exposure Check

This test checks whether Magento backup files (backup.sql, backup.zip, etc.) are publicly accessible. Their exposure allows an attacker to steal all your customer data and compromise your business.

Read article → Sensitive Files

Shopify Log File Exposure Check

This test checks whether Shopify log files (in /logs/, /var/log/, etc.) are publicly accessible. These logs contain detailed information about errors, admin accesses, API requests, and sometimes personal data. Their exposure can facilitate targeted attacks or information theft.

Read article → Sensitive Files

Magento env.php File Access Check

This test checks whether the Magento configuration file (app/etc/env.php) is publicly accessible. This file contains database credentials, encryption keys, and security settings. Its exposure allows an attacker to steal your data and take control of your store.

Read article → Sensitive Files

WordPress Backup File Exposure Check

This test checks whether WordPress backup files (backup.sql, backup.zip, backup.tar, backup.gz, etc.) are publicly accessible. These files contain your entire database, files, and sometimes credentials. Their exposure allows an attacker to steal all your data, copy your site, or destroy it.

Read article → Sensitive Files

Installation Log File Exposure Check

This test checks whether installation log files (install.log, setup.log, install.txt, installation.log, install.php, setup.php) are publicly accessible. These files often contain detailed information about the environment, database, configuration errors, or temporary credentials used during installation. Their exposure constitutes a major security flaw.

Read article → Sensitive Files

Drupal settings.php File Access Check

This test checks whether the Drupal configuration file (sites/default/settings.php) is publicly accessible. This file contains database connection credentials, hash salts, and security settings for your Drupal site. Its exposure allows an attacker to steal your data and take control of your site.

Read article → Sensitive Files

Joomla configuration.php Exposure Check

This test checks whether the Joomla configuration file (configuration.php) is publicly accessible. This file contains database credentials, security keys, and site parameters. Its exposure allows an attacker to take full control of your site.

Read article → Sensitive Files

Magento Cache Folder Access Check

This test checks whether the Magento cache folder (var/cache/) is publicly accessible. This folder contains cache files that may reveal information about your store structure, session data, or code fragments. Its exposure can facilitate attacks or information theft.

Read article → Sensitive Files

Drupal Log File Exposure Check

This test checks whether Drupal log files (in sites/default/logs/, logs/, watchdog.log, etc.) are publicly accessible. These logs contain detailed information about errors, admin accesses, SQL queries, and sometimes personal data or intrusion attempts. Their exposure can facilitate targeted attacks or information theft.

Read article → Sensitive Files

Authentication File Exposure Check (.htpasswd, .user.ini)

This test checks whether authentication files like .htpasswd (used for password protection on Apache) or .user.ini (PHP configuration) are publicly accessible. These files contain hashed (or plaintext) passwords that, if exposed, could allow an attacker to crack credentials or bypass authentication. Their exposure is a critical flaw.

Read article → Sensitive Files

Configuration File Exposure Check

This test checks whether sensitive configuration files (like .env, config.php, settings.php) are publicly accessible. These files often contain credentials, API keys, and critical application settings. Their exposure can lead to complete compromise of your site and data.

Read article → Sensitive Files

Database Backup File Exposure Check

This test checks whether database backup files (like backup.sql, database.sql, dump.sql, .bak) are publicly accessible. These files contain the entirety of your site's data: user accounts, orders, articles, etc. Their exposure is a critical flaw that can lead to massive data theft.

Read article → Sensitive Files

Drupal Backup File Exposure Check

This test checks whether Drupal backup files (backup.sql, backup.zip, backup.tar, backup.gz, etc.) are publicly accessible. These files contain your entire database, files, and sometimes credentials. Their exposure allows an attacker to steal all your data, copy your site, or destroy it.

Read article → Sensitive Files

robots.txt File Check

This test checks for the presence and accessibility of the robots.txt file at your site root. This file tells search engines (Google, Bing, etc.) which pages they can crawl or ignore. Its absence may lead to indexing of sensitive pages (admin, backups, etc.) and harm your SEO.

Read article →

Header Security

X-Content-Type-Options: nosniff Header Check

This test checks for the presence of the HTTP X-Content-Type-Options: nosniff header. This header prevents the browser from interpreting a file with a MIME type different from that declared in the Content-Type header. It protects against MIME sniffing attacks, where an attacker attempts to execute a malicious file (e.g., script) by disguising it as an image.

Read article → Header Security

Content-Security-Policy Header Check

This test checks for the presence and configuration of the Content-Security-Policy (CSP) header. It allows you to define allowed content sources (scripts, images, styles), thereby preventing unauthorised script execution (XSS) and malicious content injections.

Read article → Header Security

CORS Configuration Check (Access-Control-Allow-Origin)

This test checks the configuration of the Access-Control-Allow-Origin header. A value of '*' allows all origins, which can expose your APIs, user data, or sensitive files to cross-origin attacks (CSRF, data theft). A restrictive configuration is essential for modern web application security.

Read article → Header Security

Shopify Referrer-Policy Header Check

This test checks whether the Referrer-Policy header is present and correctly configured on your Shopify store. This header controls referrer information sent during requests. An overly permissive policy can expose sensitive data, while a restrictive policy protects customer privacy.

Read article → Header Security

Cross-Origin-Embedder-Policy Header Check

This test checks for the presence of the Cross-Origin-Embedder-Policy (COEP) header. This header allows you to control which cross-origin resources can be embedded in your site, protecting against cross-origin information leak attacks and content injections.

Read article → Header Security

Information Leak via HTTP Headers Check

This test detects the presence of sensitive HTTP headers that disclose technology information (framework, server version, language). This information can be used by attackers to target specific vulnerabilities of those technologies.

Read article → Header Security

Shopify Content-Security-Policy Header Check

This test checks the presence and configuration of the Content-Security-Policy (CSP) header on your Shopify store. This header allows you to control allowed content sources, limiting the risk of malicious script injection (XSS) and unauthorised resource loading.

Read article → Header Security

Cross-Origin-Resource-Policy Header Check

This test checks the presence and configuration of the Cross-Origin-Resource-Policy header. This header allows you to control which origins can access your resources (images, scripts, styles). A misconfiguration can expose your resources to malicious sites.

Read article → Header Security

Cache Policy Check (Cache-Control, Pragma, Expires)

This test checks the configuration of HTTP cache headers (Cache-Control, Pragma, Expires). An improper cache policy may store sensitive data in the user's browser or in proxies, exposing session or personal information. Conversely, an overly restrictive cache can degrade your site's performance.

Read article → Header Security

Shopify HTTP Security Headers Check

This test checks for the presence of essential security headers on your Shopify store (HSTS, X-Frame-Options, CSP, etc.). These headers protect against clickjacking, XSS, MIME sniffing, and ensure secure (HTTPS) connections. Missing headers expose your site to common vulnerabilities.

Read article → Header Security

Cross-Origin-Opener-Policy Header Check

This test checks for the presence of the Cross-Origin-Opener-Policy (COOP) header. This header allows you to control whether your site can be opened in cross-origin browsing contexts, protecting against cross-origin information leak attacks.

Read article → Header Security

Shopify Permissions-Policy Header Check

This test checks whether the Permissions-Policy header is present on your Shopify store. This header allows you to limit the use of browser features (camera, microphone, geolocation) by your site, protecting customer privacy against potential abuse.

Read article → Header Security

Shopify HSTS Header Check

This test checks whether the HSTS header is present on your Shopify store. This header forces browsers to connect exclusively over HTTPS, protecting your customers against downgrade attacks and connection hijacking. Its absence exposes your site to security risks.

Read article → Header Security

Shopify X-Content-Type-Options Header Check

This test checks for the presence of the X-Content-Type-Options: nosniff header on your Shopify store. This header prevents the browser from interpreting a file with a MIME type different from that declared, protecting against MIME sniffing attacks. Its absence exposes your site to risks of malicious script execution.

Read article → Header Security

Clear-Site-Data Header Check

This test checks for the presence of the Clear-Site-Data header. This header allows you to delete browsing data (cookies, cache, localStorage) after logout, protecting user sensitive information from subsequent access.

Read article → Header Security

Permissions-Policy Header Check

This test checks for the presence of the Permissions-Policy header (formerly Feature-Policy). It allows you to control which browser features (camera, microphone, geolocation, etc.) can be used by your site. Absence or an overly permissive policy can expose your users to privacy risks or abuse.

Read article → Header Security

Referrer-Policy Header Check

This test checks for the presence and configuration of the Referrer-Policy header. It controls the referrer information sent during HTTP requests. A misconfigured policy can expose sensitive data (full URLs, parameters, etc.) to third‑party sites, harming privacy and security.

Read article → Header Security

Shopify XSS Protection Check

This test checks for the presence of XSS protection headers on your Shopify store, notably X-XSS-Protection and a proper CSP configuration. XSS attacks can allow attackers to inject malicious scripts, steal sessions, and compromise user experience.

Read article → Header Security

X-Frame-Options Header Check

This test checks for the presence and configuration of the X-Frame-Options header. It prevents your site from being embedded in an iframe on a third‑party site, protecting your users against clickjacking attacks where an attacker overlays invisible elements on your site to trick the user.

Read article → Header Security

Shopify X-Frame-Options Header Check

This test checks whether the X-Frame-Options header is present on your Shopify store. This header prevents your site from being embedded in iframes by third‑party sites, protecting against clickjacking attacks. Without it, an attacker can overlay elements on your site to trick your customers.

Read article →

CMS Security

PrestaShop Session Cookie Security Check

This test checks whether PrestaShop session cookies are protected by the Secure (transmitted only over HTTPS) and HttpOnly (inaccessible via JavaScript) flags. Without these flags, cookies can be intercepted by attackers, especially via XSS attacks, allowing session and admin account theft.

Read article → CMS Security

Magento Version Check

This test detects the Magento version installed on your store via HTTP headers or meta tags. An exposed version enables attackers to search for specific vulnerabilities and exploit them. Outdated Magento versions are a major cause of intrusions on e‑commerce sites.

Read article → CMS Security

PrestaShop Version Check

This test detects the PrestaShop version installed on your store (via HTTP headers or meta tags). An exposed version enables attackers to search for specific vulnerabilities and exploit them. Outdated PrestaShop versions are a major entry point for attacks on e‑commerce sites.

Read article → CMS Security

Shopify Password Protection Check

This test checks whether your Shopify store is password protected. Shopify offers a password protection feature for stores in development or maintenance. It allows access only to authorised people (clients, testers, team) and prevents the public from seeing a site under construction. Lack of protection can expose sensitive information or an unfinished site.

Read article → CMS Security

Shopify Cart Endpoint Exposure Check

This test checks whether Shopify cart endpoints are publicly accessible. These endpoints handle cart operations (add, remove, modify) and can be exploited to manipulate a user's cart or make fraudulent purchases. Insufficient protection can result in financial losses.

Read article → CMS Security

PrestaShop Admin Login Page Protection Check

This test checks for a CAPTCHA on the PrestaShop admin login page (often /admin). Without it, attackers can use automated scripts to guess admin account credentials, leading to store takeover and customer data theft.

Read article → CMS Security

Joomla Version Check

This test detects the Joomla version installed on your site (via HTTP headers or meta tags). An exposed version enables attackers to search for specific vulnerabilities and exploit them. Outdated Joomla versions are one of the leading causes of intrusions.

Read article → CMS Security

WordPress Version Check

This test detects the WordPress version installed on your site (via HTTP headers or meta tags). An exposed version enables attackers to search for specific vulnerabilities and exploit them. Outdated WordPress versions are one of the leading causes of intrusions.

Read article → CMS Security

Drupal Admin Access Check

This test checks whether access to the Drupal administration interface (usually /admin) is restricted. Public access exposes your site to brute‑force attacks, where automated scripts try to guess administrator credentials. Protecting this area is essential to prevent site takeover.

Read article → CMS Security

Access to wp-cron.php Check

This test checks whether wp-cron.php is publicly accessible. This file executes WordPress scheduled tasks (updates, backups, scheduled posts). If accessible, an attacker can repeatedly request it to saturate your server resources (DoS attack). This vulnerability can significantly slow down or make your site unavailable.

Read article → CMS Security

WordPress REST API Access Check

This test checks whether the WordPress REST API is publicly accessible. By default, it exposes information like posts, authors, comments, and sometimes users. If sensitive data is exposed (e.g., email addresses, custom fields), it can facilitate user enumeration or preparation of targeted attacks.

Read article → CMS Security

Drupal Admin Login Page Protection Check

This test checks for a CAPTCHA on the Drupal admin login page (usually /user/login). Without it, attackers can use automated scripts to guess admin credentials, leading to a complete takeover of your Drupal site.

Read article → CMS Security

Joomla REST API Access Check

This test checks whether the Joomla REST API is publicly accessible. By default, it exposes information about articles, categories, users, and site settings. If sensitive data is exposed (e.g., email addresses, custom fields, tokens), it can facilitate user enumeration or preparation of targeted attacks, compromising your site's confidentiality.

Read article → CMS Security

Joomla Admin Login Page Protection Check

This test checks for a CAPTCHA on the Joomla admin login page (administrator/index.php). Without it, attackers can use automated scripts to guess administrator account credentials, leading to site takeover if weak passwords are used.

Read article → CMS Security

Shopify Version Check

This test detects the version of your Shopify store (via HTTP headers or meta tags). Although Shopify handles updates automatically, some theme or app versions may expose information. An exposed version can help attackers identify specific vulnerabilities.

Read article → CMS Security

Joomla Cron Access Check

This test checks whether Joomla cron is publicly accessible. Like WordPress, an accessible cron can be used for denial‑of‑service (DoS) attacks by repeatedly invoking it, which can saturate your server resources.

Read article → CMS Security

Joomla Administrator Interface Access Check

This test checks whether access to the Joomla administration interface (usually /administrator) is restricted. Public access exposes your site to brute‑force attacks where automated scripts try thousands of password combinations to access your dashboard. Protecting this area is essential to avoid any compromise.

Read article → CMS Security

Shopify Admin Access Restriction Check

This test checks whether access to Shopify administration is restricted or protected. Shopify offers mechanisms like two‑factor authentication (2FA) and user account management. Weak protection or lack of restrictions exposes your store to unauthorised access, which can lead to malicious modifications, data theft, or fraud.

Read article → CMS Security

CMS Vulnerability Check

This test detects your CMS version (WordPress, Joomla, Drupal, etc.) via HTTP headers or meta tags. An exposed version allows attackers to identify known vulnerabilities and exploit them. Outdated CMSs are the leading cause of website intrusions.

Read article → CMS Security

PrestaShop Admin Access Restriction Check

This test checks whether access to the PrestaShop administration interface is restricted. Unprotected access exposes your e‑commerce store to major risks, including customer data theft, fraud, and malicious catalogue modifications.

Read article → CMS Security

Magento Admin Access Restriction Check

This test checks whether access to the Magento administration interface is restricted. Unprotected access exposes your e‑commerce store to major risks, including customer data theft, fraud, and malicious catalogue modifications. Securing this area is an absolute priority.

Read article → CMS Security

WordPress Admin Access Check

This test checks whether access to the WordPress administration interface (usually /wp-admin) is restricted. Public access can expose your site to brute‑force attacks, where scripts try thousands of password combinations to access your dashboard. Protecting this area is essential for your site security.

Read article → CMS Security

Drupal Version Check

This test detects the Drupal version installed on your site via HTTP headers or meta tags. An exposed version enables attackers to search for specific vulnerabilities and exploit them. Outdated Drupal versions are a major cause of intrusions.

Read article → CMS Security

WordPress Heartbeat API Check

This test checks whether the Heartbeat API is active on your site. It allows WordPress to execute periodic AJAX requests to sync data (e.g., notifications, post locking). A high frequency can overload the server and be exploited for DoS attacks.

Read article → CMS Security

Magento Admin Access Check

This test checks whether access to the Magento administration interface (usually /admin) is restricted. Public access exposes your e‑commerce store to brute‑force attacks. Protecting this area is essential to prevent site takeover and theft of sensitive data (orders, customers, payment methods).

Read article → CMS Security

PrestaShop Admin Access Check

This test checks whether access to the PrestaShop administration interface (usually /admin or a custom path) is restricted. Public access exposes your store to brute‑force attacks, where automated scripts try to guess administrator credentials. Protecting this area is essential to avoid store takeover and customer data leaks.

Read article → CMS Security

xmlrpc.php Access Check

This test checks whether xmlrpc.php is publicly accessible. This file enables communication between WordPress and other services (e.g., mobile apps, WordPress clients). It is known to be a target for brute‑force attacks (e.g., XML‑RPC brute force with the 'wp.getUsersBlogs' action) and denial‑of‑service (DDoS) attacks.

Read article → CMS Security

Magento Session Cookie Security Check

This test checks whether Magento session cookies are protected by the Secure (transmitted only over HTTPS) and HttpOnly (inaccessible via JavaScript) flags. Without these flags, cookies can be intercepted by attackers, especially via XSS attacks, allowing session and admin account theft.

Read article → CMS Security

Magento Admin Login Page Protection Check

This test checks for a CAPTCHA on the Magento admin login page. Without it, attackers can use automated scripts to guess admin credentials.

Read article → CMS Security

Shopify REST API Exposure Check

This test checks whether the Shopify REST API is publicly accessible. This API allows retrieval and modification of your store data (products, orders, customers). Insecure exposure can allow attackers to steal data, modify orders, or compromise your business.

Read article → CMS Security

Drupal Admin Access Restriction Check

This test checks whether access to the Drupal administration interface is restricted. Insufficient protection exposes your site to brute‑force attacks, malicious modifications, and data theft. Securing this area is a top priority.

Read article → CMS Security

admin-ajax.php Accessibility Check

This test checks whether admin-ajax.php is accessible and returns a response without authentication. This file is used by WordPress to process AJAX requests (e.g., content loading, form submissions, admin actions). If an attacker can access this file without being authenticated, they can exploit certain unprotected actions, cause data leaks, or execute unauthorised actions on your site.

Read article → CMS Security

Joomla Admin Access Check

This test checks whether access to the Joomla administration interface (usually /administrator) is restricted. Public access exposes your site to brute‑force attacks, where scripts try thousands of password combinations to access your dashboard. Protecting this area is essential because it allows full control of the site, content modification, extension installation, or configuration changes.

Read article → CMS Security

WordPress Login Page Access Check (wp-login.php)

This test checks whether the WordPress login page (wp-login.php) is accessible and protected by a CAPTCHA. Without protection, this page is exposed to brute‑force attacks, where automated scripts try to guess your login credentials. Effective protection is essential to prevent unauthorised access to your dashboard.

Read article → CMS Security

Shopify Storefront API Exposure Check

This test checks whether the Shopify Storefront API is publicly accessible. This API allows interaction with your store data (products, collections, cart) and can expose sensitive information if not correctly protected. Insecure exposure can allow attackers to retrieve product data, manipulate the cart, or exploit vulnerabilities.

Read article → CMS Security

WordPress Theme Editor Access Check

This test checks whether the WordPress theme editor (theme-editor.php) is accessible. This tool allows direct modification of your theme's PHP, CSS, and JavaScript files from the admin interface. If an attacker gains authenticated access, they can insert malicious code or alter your site's functionality, leading to critical risks.

Read article →