CheckCyber audits any website's public security posture in seconds. No signup, no install, nothing to configure. 24 checks: TLS certificate and protocols, HTTPS redirection, security headers (HSTS, CSP, X-Frame-Options), cookies, CORS, exposed files (.env,git, backups), version leaks, script integrity (SRI), vulnerable JS libraries, and DNS/email records (SPF, DMARC, CAA, MTA-STS). Score out of 100, plus the exact fix for each issue (Apache, nginx, WordPress).

Hi Product Hunt 👋 I built CheckCyber after one too many conversations with small business owners who had no idea their site was leaking something obvious — a .env file at the root, an expired certificate, a domain anyone could spoof emails from. The tools that already existed frustrated me for the same reason every time: they hand you a grade and a list of acronyms. "CSP: missing." Great — now what? If you're not a security engineer, that report is useless. So CheckCyber does two things differently: 1. It runs 24 checks from the outside only — exactly what an attacker or a crawler sees. Nothing to install, no access to your server, no account. Type a URL, get a report. 2. Every single finding comes with the actual fix. Not "add a CSP header" but the .htaccess block, the nginx directive, or the WordPress step, ready to paste. It's built with SvelteKit, fully prerendered, and the scan itself is non-intrusive — read-only requests, nothing an ordinary browser wouldn't do. Fair warning: the interface and reports are in French for now. The scan works on any site in the world, but you'll be reading the results in French. An English version is on the roadmap — tell me if that's something you'd want. Happy to answer anything about the checks, the scoring, or how the DNS/email side works.

Ran it on my own site and the nginx config snippets for HSTS and CSP were actually copy-paste ready, not generic advice. Surprised how much it caught in just a few seconds without needing to sign up for anything.

Ran it against a side project I forgot about and it caught a stale TLS protocol and a missing CSP header I didn't even realize were issues. Love that it gives the actual nginx snippet for each fix instead of just flagging the problem.

CheckCyber

Scan any website for 24 security flaws in seconds

Scan any website for 24 security flaws in seconds