Why 60% of production apps fail defensive security audits, and how to test HSTS, CSP, and DNS records with 1 line of terminal code.

We spend countless hours tweaking unit tests, Docker builds, and database indexes. Yet, one of the easiest attack vectors is also the one most teams forget: HTTP defensive security headers. Without strict headers, your app can leave users exposed to: SSL-Stripping / MitM (missing Strict-Transport-Security with preload) Clickjacking & iFrame hijacking (missing X-Frame-Options) XSS & malicious script injection (missing Content-Security-Policy) Domain spoofing & phishing (unconfigured DNS SPF/DMARC) To solve this for my own deployment pipelines without dealing with slow web UIs or enterprise sales walls, I built SiteScanAPI — a passive, edge-powered scanner and zero-auth REST API that audits any domain in under 250 milliseconds. 🛠️ The Problem with Existing Scanners Most security checkers out there fall into one of two camps: Interactive-only web tools with no clean, programmatic REST API for automated CI/CD checks. Heavy vulnerability suites that require accounts, API keys, credit cards, or run intrusive network probing that can trigger firewall bans. I wanted something lightweight, passive, and instantaneous that could be queried from curl, GitHub Actions, or a monitoring cron job. ⚡ How It Works Under the Hood The engine runs on globally distributed edge workers (Cloudflare Edge). When an audit request comes in: Non-Intrusive HTTP Interrogation: Sends standard passive GET/HEAD requests to inspect returned headers without testing invasive payloads. Strict RFC & W3C Analysis: Evaluates HSTS max-age, CSP directives, Referrer-Policy, and Permissions-Policy against current standards. Next-Gen Origin Isolation: Checks modern browser boundaries like Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP). Parallel DNS-over-HTTPS (DoH): Resolves and audits SPF and DMARC records to flag email spoofing risks. Vulnerability Disclosure (RFC 9116): Confirms whether /.well-known/security.txt exists for white-hat reports. Information Leak Scrape: Flags banner disclosures like Server: Apache/2.4.41 or X-Powered-By: Express. 💻 Try It in 1 Line of Code No API keys, no registration. Open your terminal: curl -s "https://sitescanapi.com/api/scan?url=github.com" | jq Example JSON Response { "target": "github.com", "score": 95, "grade": "A+", "summary": { "passed": 11, "warnings": 1, "failed": 0 }, "checks": [ { "name": "Strict-Transport-Security", "header": "strict-transport-security", "present": true, "status": "pass", "value": "max-age=31536000; includeSubDomains; preload", "recommendation": "Enforces HTTPS connections and preloading." }, { "name": "Content-Security-Policy", "header": "content-security-policy", "present": true, "status": "pass" } ], "dns": { "spf": { "present": true, "status": "pass" }, "dmarc": { "present": true, "status": "pass" } } } 🤖 Automate It in GitHub Actions You can drop this step into your CI/CD workflow to fail builds if someone pushes a change that degrades your production security posture: name: Security Perimeter Audit on: deployment_status: jobs: audit-headers: if: github.event.deployment_status.state == 'success' runs-on: ubuntu-latest steps: - name: Audit Production Security Score run: | DOMAIN="yourdomain.com" RESPONSE=$(curl -s "https://sitescanapi.com/api/scan?url=${DOMAIN}") SCORE=$(echo "$RESPONSE" | jq -r '.score') GRADE=$(echo "$RESPONSE" | jq -r '.grade') echo "Perimeter Security Grade: $GRADE ($SCORE/100)" if [ "$SCORE" -lt 80 ]; then echo "❌ Security score below minimum threshold (80). Check missing headers!" exit 1 fi echo "✅ Security headers check passed!" 🔧 2-Minute Quick Fixes If your site scores below an A, here are the most impactful fixes: Nginx # Add to your server block add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; # Strip server banner disclosure server_tokens off; Cloudflare (_headers file) /* Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: DENY Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=() 🚀 Test Your Domain You can test any domain live using the web interface or directly via the API: 🌐 Web Dashboard: sitescanapi.com 📡 API Endpoint: https://sitescanapi.com/api/scan?url={domain} 💬 Discussion What score did your production domain get? What has been your biggest headache when implementing a strict Content Security Policy (CSP)? Drop your domain or thoughts in the comments below!