I scanned my own sites for security issues. Here’s the checklist I wish I’d had.

I've been building a website scanner as a side project, and the first thing I did was point it at my own sites. It was humbling.

None of the problems were exotic. They were the boring, five-minute fixes that almost everyone skips. So here's the checklist I now run on every site I ship.

1. Security headers

Most sites I tested were missing at least one of these:

• Strict-Transport-Security (HSTS) – forces HTTPS so nobody gets downgraded to plain HTTP.
• Content-Security-Policy (CSP) – limits where scripts can load from. Your best defense against XSS.
• X-Content-Type-Options: nosniff – stops browsers from guessing file types.
• X-Frame-Options / frame-ancestors – prevents your site from being embedded for clickjacking.
• Referrer-Policy – controls how much URL info leaks to other sites.

On Vercel, Netlify or Nginx, these are a few lines of config. There's no excuse to skip them.

2. Mixed content

Your site is on HTTPS, but one old image or script still loads over http://. Browsers may block it or show warnings. Search your codebase for http:// and fix every hit.

3. Exposed files that should never be public

Try these on your own domain right now:

• /.git/
• /.env
• /backup.zip, /db.sql

If any of them return something other than a 404, you have a real problem. Leaked .env files are one of the most common ways API keys get stolen.

4. Outdated libraries on the frontend

That jQuery or Bootstrap version from 2018 may carry known vulnerabilities. Check what you're actually serving, not just what's in package.json.

5. Performance is part of security hygiene too

Slow, bloated pages usually mean lots of third-party scripts. Every script you don't control is a supply-chain risk. Audit them, drop what you don't need.

Why I built a tool for this

Doing all of the above manually for every project got old fast, so I built PerfoMetrix: paste a URL and it checks security and performance in one report. There's a free tier, so you can run it on your own sites without signing up for anything paid.

I'm building it solo and still shaping it, so I'd genuinely love feedback:
What's the one check you'd want a scanner like this to run that most tools miss?

Drop it in the comments 👇