Website DNA: an n8n workflow sequences your homepage and finds third parties and CVEs

Try it first: the DNA of your website. Enter a domain, press “Sequence”, and after about twenty seconds the helix starts turning. No domain at hand? The demo button fills in daniele-michelin.com.

How to read the helix

• One base pair = one building block: every library, every foreign service, the site's own scripts and stylesheets, cookies and server technology with a version, plus eight pairs for protection (six security headers, HTTPS, TLS).
• Blue = own code: everything that comes from the site's own host or one of its subdomains.
• Violet = third party: CDN, analytics, fonts, video, chat, maps, ads. Each of these hosts receives the visitor's IP address on page load.
• Green = protection on, amber = protection missing: the security headers and the encryption.
• Red and pulsing = known vulnerability: a library in a version with a CVE.
• Controls: drag to rotate the helix, otherwise it turns slowly on its own. Hover a base and a holographic label shows name, version, host and the CVEs with their severity. On a phone you tap, on a keyboard the arrow keys pick a pair. At the start the helix is sequenced base by base, with a counter like in a lab.

The useful part: the genome report

Next to the helix the same findings appear as text. This is the part you can actually work with.

• Composition: what share of the resources is own and what is foreign, split into scripts, CSS, fonts, iframes and images.
• Third parties and the GDPR: the list of foreign hosts with service and category. Each one loads with the page and learns the visitor's IP address. That needs a legal basis, and for Google Fonts, YouTube or analytics it is often consent. The list shows what belongs in the privacy policy and the cookie banner.
• Libraries and CVEs: versions come from the file name (jquery-3.4.0.min.js), from CDN paths, from ?ver= on WordPress and from the comment banners of the site's own JavaScript files. Every version goes to OSV.dev. Each vulnerability found appears in the report with its severity and a link to the OSV record.
• Cookies: name, lifetime and the Secure, HttpOnly and SameSite flags of the cookies the server sends with the homepage. The workflow never reads the values.
• Headers and technology: which protective headers are missing, how long the certificate is still valid, and whether the server or PHP give away their version number.
• Diagnosis and three therapies: an AI geneticist sums up the findings in three or four sentences and suggests three concrete steps, such as updating a library or hosting fonts locally.

Limits: only the homepage is measured, as the server delivers it. What JavaScript loads later is missing, and so are cookies set in the browser. Bundled files often do not reveal their libraries. The report is a quick check, not a full audit.

The workflow

• Take a sample: a small PHP script loads the homepage and at most five JavaScript files of the same host (300 KB each), only to read their version banners. Every address is resolved first and must be public; the script follows redirects itself and checks every hop. It never downloads foreign resources.
• Sequence the genome: a Code node reads every script, stylesheet, font, iframe and image from the HTML, files the hosts as own or foreign and recognises about 70 services and 50 libraries.
• Two labs in parallel: the OSV branch sends all versions in one call to api.osv.dev/v1/querybatch and then loads the records of the hits (CVE number, severity). At the same time the checkpoint measures security headers and TLS. A Merge node waits for both.
• Findings and AI: a Code node turns the results into base pairs. The geneticist is gpt-oss-120b at IONOS in Germany. It gets only the measured values and must not invent anything. If it does not answer, a template writes diagnosis and therapies from the same numbers.
• Sharing: every sample gets a link and a preview image with the helix and the counter. Whoever created it can delete it again.

Build it yourself

The workflow is ready as JSON to import. Placeholders are marked: the address of the sampler, the checkpoint, the token and the page that receives the result. For the sampler you need a small endpoint of your own with SSRF protection. OSV.dev is free and needs no key. For the AI any OpenAI-compatible API will do.

The pattern is useful day to day too: sequence your own homepage once a week and send a mail when a new third party or a new CVE shows up. More workflows to click and download are on the n8n overview.

Originally published at daniele-michelin.com. More guides, free checks (SPF, TLS, headers) and an error-message lexicon: daniele-michelin.com/en/.