Check your websites' security settings every week

Every Monday at 08:00, each website you list gets one ordinary page request, exactly what a visitor's browser makes, and only that response is read. Nothing is probed, no paths are guessed and no address other than the ones you list is contacted, so it is a passive check of sites you own, not a scanner.

The email you get names, for each site, which of Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy are missing, whether a visitor arriving over plain http is sent on to https, and the server banner verbatim. AI then explains what each missing header does and the change to make in your web server or CDN, and is told not to judge how exploitable anything is or invent findings. The readings go out even if the write-up fails. A site that cannot be reached is listed separately with the reason and never stops the rest being checked.

Put only sites you are responsible for in the list, since each one is requested every week.

Run every Monday at 08:00.Run every Monday at 08:00.

Set siteList to blank.Set siteList to blank.

Set reportEmail to blank.Set reportEmail to blank.

Split siteList with replaced by "Split siteList with replaced by with , replaced by by a new line and save it as siteEntries.

Set siteReports to an empty list.Set siteReports to an empty list.

Set unreachable to an empty list.Set unreachable to an empty list.

Set sitesWithGaps to 0.Set sitesWithGaps to 0.

For each siteEntry in siteEntries:For each siteEntry in siteEntries:

Trim siteEntry and save it as entry.Trim siteEntry and save it as entry.

If entry is emptyIf entry is empty

Yes

Skip to the next item.Skip to the next item.

No

No steps

Replace http:// with in entry with https:// replaced by (ignoring case) (ignoring case) and save it as siteHost.Replace http:// with in entry with https:// replaced by (ignoring case) (ignoring case) and save it as siteHost.

If siteHost is emptyIf siteHost is empty

Yes

Skip to the next item.Skip to the next item.

No

No steps

Set checkUrl to http://@siteHost.Set checkUrl to http://@siteHost.

Set reached to false.Set reached to false.

Set finalUrl to blank.Set finalUrl to blank.

Set responseStatus to 0.Set responseStatus to 0.

Set responseHeaders to an empty record.Set responseHeaders to an empty record.

If a step below fails, save the error as fetchErrorIf a step below fails, save the error as fetchError

Try

Fetch checkUrl and save it as response.Fetch checkUrl and save it as response.

Trim response.url and save it as finalUrl.Trim response.url and save it as finalUrl.

Change responseStatus to response.status.Change responseStatus to response.status.

Change responseHeaders to response.headers.Change responseHeaders to response.headers.

Change reached to true.Change reached to true.

On error

Replace checkUrl with the site address in fetchError.message and save it as safeReason.Replace checkUrl with the site address in fetchError.message and save it as safeReason.

Add siteHost - could not be reached: safeReason to the end of unreachable and save it as unreachable.Add siteHost - could not be reached: safeReason to the end of unreachable and save it as unreachable.

If reached isn't yesIf reached isn't yes

Yes

Skip to the next item.Skip to the next item.

No

No steps

Set missingHeaders to an empty list.Set missingHeaders to an empty list.

If responseHeaders["strict-transport-security"] is emptyIf responseHeaders["strict-transport-security"] is empty

Yes

Add Strict-Transport-Security to the end of missingHeaders and save it as missingHeaders.Add Strict-Transport-Security to the end of missingHeaders and save it as missingHeaders.

No

No steps

If responseHeaders["content-security-policy"] is emptyIf responseHeaders["content-security-policy"] is empty

Yes

Add Content-Security-Policy to the end of missingHeaders and save it as missingHeaders.Add Content-Security-Policy to the end of missingHeaders and save it as missingHeaders.

No

No steps

If responseHeaders["x-frame-options"] is emptyIf responseHeaders["x-frame-options"] is empty

Yes

Add X-Frame-Options to the end of missingHeaders and save it as missingHeaders.Add X-Frame-Options to the end of missingHeaders and save it as missingHeaders.

No

No steps

If responseHeaders["x-content-type-options"] is emptyIf responseHeaders["x-content-type-options"] is empty

Yes

Add X-Content-Type-Options to the end of missingHeaders and save it as missingHeaders.Add X-Content-Type-Options to the end of missingHeaders and save it as missingHeaders.

No

No steps

If responseHeaders["referrer-policy"] is emptyIf responseHeaders["referrer-policy"] is empty

Yes

Add Referrer-Policy to the end of missingHeaders and save it as missingHeaders.Add Referrer-Policy to the end of missingHeaders and save it as missingHeaders.

No

No steps

Check whether finalUrl starts with https:// (ignoring case) and save it as redirectsToHttps.Check whether finalUrl starts with https:// (ignoring case) and save it as redirectsToHttps.

Set httpsLine to HTTPS: the plain http address is sent on to finalUrl.Set httpsLine to HTTPS: the plain http address is sent on to finalUrl.

If redirectsToHttps isn't yesIf redirectsToHttps isn't yes

Yes

Change httpsLine to HTTPS: the plain http address was NOT sent on to https - it ended at finalUrl.Change httpsLine to HTTPS: the plain http address was NOT sent on to https - it ended at finalUrl.

No

No steps

Set headerLine to Security headers: all five present.Set headerLine to Security headers: all five present.

If missingHeaders isn't emptyIf missingHeaders isn't empty

Yes

Change headerLine to Missing security headers: missingHeaders joined by , .Change headerLine to Missing security headers: missingHeaders joined by , .

No

No steps

Set serverBanner to responseHeaders.server.Set serverBanner to responseHeaders.server.

Set serverLine to Server header: not sent.Set serverLine to Server header: not sent.

If serverBanner isn't emptyIf serverBanner isn't empty

Yes

Change serverLine to Server header: serverBanner.Change serverLine to Server header: serverBanner.

No

No steps

If missingHeaders isn't empty or redirectsToHttps isn't yesIf missingHeaders isn't empty or redirectsToHttps isn't yes

Yes

Add 1 to sitesWithGaps.Add 1 to sitesWithGaps.

No

No steps

Add siteHost (read at finalUrl, status responseStatus)Add siteHost (read at finalUrl, status responseStatus) httpsLine headerLine serverLine to the end of siteReports and save it as siteReports.

If siteReports is empty and unreachable is emptyIf siteReports is empty and unreachable is empty

Yes

Stop and report a problem: None of the lines in the 'siteList' step held a website address. Put one address per line, for example acme.com, then run it again.Stop and report a problem: None of the lines in the 'siteList' step held a website address. Put one address per line, for example acme.com, then run it again.

No

No steps

Join siteReports with a blank line and save it as findings.Join siteReports with a blank line and save it as findings.

If unreachable isn't emptyIf unreachable isn't empty

Yes

Change findings to findingsChange findings to findings Could not be checked: unreachable joined by a new line.

No

No steps

Set explanationText to blank.Set explanationText to blank.

If a step below fails, save the error as explainErrorIf a step below fails, save the error as explainError

Try

OpenAIAsk OpenAI: 'You are writing the plain-English part of a weekly security-header summary for the small team that owns the websites below.Ask OpenAI: 'You are writing the plain-English part of a weekly security-header summary for the small team that owns the websites below. Only the response headers of one ordinary page request per site were read - the same headers any visitor's browser receives. Nothing was scanned, probed or tested, and no address other than the ones listed was contacted. For each site with something missing, write two or three sentences: what that header does, what an ordinary visitor is left open to without it, and the concrete change to make in the web server or CDN configuration. Where a Server header names a version number, note that hiding the version is a one-line configuration change. Do not judge how exploitable anything is, do not suggest scanning or testing these sites, and do not add findings that are not in the readings below. If a site is missing nothing, say so in one line. Readings: findings'. Save it as aiAnswer.

Trim aiAnswer.response_text and save it as explanationText.Trim aiAnswer.response_text and save it as explanationText.

On error

Show in the output: The readings could not be written up, so the email carries them as they are. explainError.message.Show in the output: The readings could not be written up, so the email carries them as they are. explainError.message.

Set emailIntro to Checked the length of siteReports of your sites. sitesWithGaps have something missing.Set emailIntro to Checked the length of siteReports of your sites. sitesWithGaps have something missing. Every site was read with one ordinary page request - the same headers a visitor's browser receives. Nothing was scanned or probed.

Set emailBody to emailIntro plus findings.Set emailBody to emailIntro plus findings.

If explanationText isn't emptyIf explanationText isn't empty

Yes

Change emailBody to emailIntro@explanationTextChange emailBody to emailIntro@explanationText --- What each site returned findings.

No

No steps

GmailSend an email to reportEmail.Send an email to reportEmail. Subject: Website security headers: sitesWithGaps of the length of siteReports sites have gapsemailBody