SAASCHECKUP · KLYVIA LABS
Website security audit: HTTPS and security headers
A passive security audit examines publicly exposed website information without exploiting vulnerabilities. It helps identify configuration issues and plan proportionate follow-up checks.
Start with HTTPS
Encryption protects exchanges between the browser and the server. Confirm that public pages use HTTPS and that old HTTP addresses redirect to the secure version. A successful HTTPS response does not establish that accounts, databases or internal processing are secure. Application security also depends on components that cannot be assessed externally.
Understand protective response headers
Content-Security-Policy specifies permitted sources for scripts and other resources. X-Content-Type-Options limits certain MIME-type interpretations. Frame restrictions and referrer policies address different risks. Appropriate settings depend on the application. A present but overly permissive policy is not equivalent to a tested policy tailored to the service.
Worked example: missing CSP
If no CSP is observed, check both HTTP headers and possible meta policies. Inventory legitimate scripts, styles, images and network connections. Test a suitable policy in a staging environment, or start with Report-Only before enforcement. Copying a strict policy without testing can break sign-in or checkout. This educational example does not mean an attack was detected.
Keep evidence proportional to the conclusion
An exposed public component, a missing header and an exploitable vulnerability are different findings. Useful evidence identifies the received response and affected URL. An unexecuted check remains unknown. SaaSCheckup documents accessible passive-security signals; it is not a penetration test, a private source-code review or a compliance certification.
Verify the fix
Repeat the check against the response actually served, then test affected journeys on mobile and desktop. Review console errors, blocked resources and legitimate integrations. Suspected authentication, access-control or sensitive-data issues require a separately authorized internal review. A public report helps prioritize that review without proving that all security risks have been eliminated.
Further reading
Check your own website
Free: 3 lifetime audits per verified account. Premium: €19.90 including VAT per audit, with no subscription.
Inspection scope · Compare plans