The Sniffer Website Security Baseline Checker
A free, public, server-side security checker. It analyzes the publicly visible configuration of a single URL and produces a 100-point baseline score. It is a first-pass diagnostic, not a full penetration test.
About this tool
Clickerwayne Zelle built the Security Baseline Check to provide a fast, single-page diagnostic for websites. It is a server-side engine engineered in the Philippines, serving the local market and international clients in the US, UK, Canada, Australia, and the UAE.
This public tool is free, rapid, and precise. It does not execute JavaScript, and it does not perform intrusive penetration testing. It runs six deterministic checks on a single URL and returns a score based on structural misconfigurations. For comprehensive vulnerability assessments, scoped penetration tests, or enterprise-scale audits, Clickerwayne Zelle provides those capabilities through our dedicated Security Audits services.
Website Security Checker
Checks the layers a visitor, a browser, and an attacker actually touch. Produces a 100-point baseline score. This is a baseline check, not an audit.
Audit Methodology
The auditor evaluates the technical conditions that affect a site's security posture. Each check carries a fixed weight, aligned with OWASP recommendations and standard web security practices.
| Check | Weight |
|---|---|
| Security Headers (HSTS, CSP, etc.) | 30 pts |
| Cookie Flags (Secure, HttpOnly, SameSite) | 22 pts |
| Exposed Files (.env, .git, etc.) | 15 pts |
| Transport Security (HTTP to HTTPS) | 10 pts |
| Form Safety (CSRF, HTTPS actions) | 10 pts |
| Clone Signal (Runtime domain checks) | 3 pts |
Security Architecture
Running a public audit tool is a security risk if it is not engineered correctly. This auditor was built with strict Server-Side Request Forgery (SSRF) defenses and transparent bot identification.
Verified Bot Identity
All requests use the official SnifferBot/1.0 User-Agent. Webmasters can verify traffic in their server logs.
SSRF Protection
The fetcher resolves the target IP, pins it, and blocks connections to private IPv4 and IPv6 ranges before any request is made.
DNS Rebinding Defense
The resolved IP is pinned for the duration of the request, preventing DNS rebinding attacks that could redirect the server to an internal network.
Domain Blocklist
Audits of Clickerwayne Zelle and Wholesale Dito Store are explicitly blocked to prevent self-scoring, preserving the integrity of the audit data.
Memory Safe
A custom write callback enforces a 2MB limit on streaming or chunked HTTP payloads, preventing memory exhaustion from malicious responses.
Zero Data Retention
We do not store the URLs you scan, the results, or your IP address. The audit runs in server memory and is discarded immediately after the report is generated.
Frequently Asked Questions
What is a security baseline check?
A security baseline check analyzes the publicly visible configuration of a website, such as security headers, cookie flags, and exposed files, to identify missing protections. It is a quick check, not a full penetration test.
What does a Grade B score mean?
A Grade B indicates the site covers most baseline layers but is missing a few specific configurations. The "What to fix first" section lists the exact actions required to reach a Grade A.
Can this tool detect SQL injection or XSS?
No. The tool performs non-intrusive checks only. It does not send malicious payloads, test for injection points, or attempt to clone the site. Detecting those vulnerabilities requires a scoped penetration test.
How is this different from a full security audit?
A full audit includes manual testing, internal network analysis, authentication flow review, and a written report ranked by severity. This tool provides a public, automated baseline check that takes seconds. Clickerwayne Zelle offers full security audits as a separate engagement.