What’s the one website security check you always forget?

I’ve run websites and servers for 20+ years, and the same issues keep showing up on sites that look perfectly fine from the outside. No DMARC record (so anyone can send email as your domain), missing security headers, and the scary one, a .env file sitting publicly reachable next to the homepage.

I recently built a free checker for this (ShieldCheck, launching here on 14 Nov), and while building it I kept finding things even experienced devs skip.

Curious what this community does:

1. What do you check before a site goes live?

2. Which check has actually saved you, or which one did you learn about the hard way?

3. Anything you wish a scanner caught that most don’t?