Developer scans own sites and lists five basic security checks most sites miss

A developer building a website scanner tested their own sites and found that common, easily fixed security gaps were widespread. The checklist highlights missing HTTP security headers such as HSTS, CSP, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy, which can typically be configured in a few lines on platforms like Vercel, Netlify, or Nginx. It also recommends checking for mixed content loaded over HTTP, testing for exposed sensitive files like .git directories, .env files, and database backups, and auditing outdated libraries and unnecessary third-party scripts. The author notes they built a free-tier tool called PerfoMetrix to automate these checks and is seeking community feedback on additional features.