Web Security·Published 2026-08-30

Website Security Health Monitor

A passive security auditing utility that analyzes HTTP response headers, TLS posture, DNS security records, and exposed technology banners.

Open Live Tool

The Problem

Many small businesses and developers inadvertently deploy websites lacking fundamental security headers (CSP, HSTS, X-Content-Type-Options) and email authentication records (SPF, DMARC), leaving them vulnerable to clickjacking, MIME-sniffing, and domain spoofing.

Project Context

Engineered a passive, non-intrusive security inspection tool built with Next.js and Node.js. It evaluates public HTTP headers and DNS configurations without performing aggressive scanning or vulnerability probing.

System Architecture & Data Flow

The client inputs a domain, and the backend server executes non-intrusive DNS queries and a safe single HTTP GET request with restricted timeouts.

Architecture Pipeline

Step 01

User enters target domain in the web interface.

Step 02

Input validation strips schemes, paths, and invalid characters to prevent SSRF and injection.

Step 03

Node.js DNS module queries MX, TXT (SPF), and _dmarc records asynchronously.

Step 04

Safe HTTPS request inspects response headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

Step 05

Rules engine computes compliance status (Pass / Warning / Missing) with clear explanations and remediation code.

Step 06

Clean report displayed with clear disclaimer highlighting passive assessment scope.

Technologies & Tools Used

Next.js 15 (App Router)TypeScriptNode.js DNS & Fetch APIsTailwind CSS

Security Considerations

•Strict SSRF protections: IP addresses resolved to private RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.1) are rejected immediately.
•Passive assessment only: zero fuzzing, zero exploitation payloads, zero high-rate requests.
•Requests run with 5-second connection timeouts and do not follow untrusted redirect loops.

Implementation Notes

• Built a dedicated parser for Content-Security-Policy directives evaluating default-src, script-src, and frame-ancestors.

• Formatted actionable remediation recommendations tailored for Nginx, Apache, and Next.js configuration files.

Engineering Challenges

Handling CDN and proxy edge behaviors where headers vary depending on geographic location or User-Agent headers.

Accurately identifying partial or overly permissive Content Security Policies (e.g. presence of unsafe-inline).

Verified Results

Used as an integrated live tool on ianjob.com (/tools/website-security-check).
Provides instant, actionable feedback for web developers auditing their defensive header posture.

Lessons Learned

•Passive header analysis reveals significant insights into an organization’s security hygiene without sending a single aggressive probe.
•Developers appreciate copy-pasteable remediation snippets rather than vague compliance warnings.

Back to all projects View related SOC Labs →