Package: ready-check
readyis a tool for developers to check how production ready their website.UsageInstall the tool from PyPI with:pip install ready-checkRunning the checks for a domain is as simple as:ready <domain>For more options, check the output of--help.Usage during developmentIf you have cloned the repository and would like to run the checks with your local version, simply run:python3 -m ready.ready <domain> [--request-filter=<x>] [--check-filter=<x>]Optional DependenciesThere are no required dependencies, but two optional dependencies that enable some additional behaviour:Installing thetldpackage adds support for using the fully-qualified domain name for some DNS-related checks. This is particularly handy if you need to check a subdomain.Installingbeautifulsoup4adds support for extracting the Content-Security-Policy from the HTML document as well as the headers. This technique can be used for sites that use static hosting like Github Pages.Note: if you install from PyPI these dependencies are installed.Check listCookies should set the SameSite flagCookies should set the Secure flagCookies should set the HttpOnly flagSwagger URLs should not return 200 (requires --fuzz)HSTS Header should be included in responseHSTS Header should have a long max-ageHSTS Header should have includeSubdomainsHSTS Header should have preloadAn AAAA DNS record exists (IPv6 Support)HTTP -> HTTPS redirection occursPermissions-Policy should exist if the response is HTMLframe-ancestors should be in CSP or X-Frame-Options should exist if the response is HTMLX-Content-Type-options should be "nosniff"Referrer-Policy should be setX-XSS-Protection header should not existHTML should start with "<!doctype html>"<html>tag should include langHTML should include meta charset tagHTML should include<title>HTML should include link with rel="icon"HTML should not use schemeless urls for links or hrefsHTML should not use unnecessary HTML entitiesAll script tags should use subresource integrityX-DNS-Prefetch-Control should be set to offCDNs should not be used for Javascript or CSS assetsRSS and JSON feeds should return Access-Control-Allow-Origin headerCache-Control max-age should be <= 86400 for HTML documentsContent-Security-Policy header should existContent-Security-Policy header should start with default-src 'none'Content-Security-Policy must include either default-src or script-srcContent-Security-Policy header must not include unsafe-inlineContent-Security-Policy header must not include unsafe-evalContent-Security-Policy header must not include report-sampleContent-Security-Policy header must not include report-uriContent-Security-Policy header should not include report-toContent-Security-Policy header should include upgrade-insecure-requestsContent-Security-Policy header only includes valid directivesAt least two nameservers should be configuredCross-Origin-Resource-Policy should be "same-origin"cross-origin-opener-policy should be "same-origin"Cross-Origin-Embedder-Policy should be "require-corp"Report-To Header must not be included in responseResponse should not contain hints of a Cloudflare captcha pageResponse should not contain hints of a Kasada error pageResponse should include a Content-TypeResponse should be gzippedContent-Type header should contain charsetExpires header is deprecated and should not be returnedCache-Control header should be included in the responseP3P header is deprecated and should not be returnedSPF TXT record should existSPF TXT record should contain "-all"SPF DNS record is deprecated and should not existSPF includes use less than 10 DNS requestsDMARC record should existDMARC record should contain p=rejectSPF should be "v=spf1 -all" if there are no MX records or MX record is "."Robots.txt exists and is a text fileSecurity.txt exists and is a text file that contains required attributesSecurity.txt has an expiry date in the futureFavicon is served at /favicon.icoHeaders that leak information should not be in the responseSSL certificate should be trustedSSL expiry should be less than one yearSSL expiry should be greater than five daysSSL connection fails when using TLS 1.1SSL connection fails when using TLS 1.0DNS CAA should be enabledDNS CAA should include accounturiDNS CAA should include validationmethodsResponse should be a 200 (after redirects)Potential / WIPGraphQL introspection is not enabledDNSSEC is supportedDKIM is configuredSPF must not contain +all or ?allDMARC / SPF configuration when there is no MX recordCSP should contain default-src or script-src (there's no XSS protection by default)Detections for different WAFs that might be returning instead of the intended content (Cloudflare, Imperva, Kasada, etc.)DNS TTL should be > 300, this reduces the number of DNS requests clients need to makeCSP: default-src or script-src must be setCSP: object-src none must be setCheck for source maps in JSHTML: contains viewportNot in scopeSome things are best left to other tools, or are generally handled in other ways by web development teams.Dependency scanning. Use a service to regularly check that you are using the latest version of your dependencies.Vulnerability scanning. This tool doesn't replace a penetration test, or automated penetration testing tools.Scans for specific CMSs (i.e. Wordpress, Drupal, etc.). You know what CMS you are using, and you should run framework/cms specific tools in addition to this.Checking for dead links. Usemuffetor similar for that one.Scans for specific WAFs (use wafw00f for detection)Standard ChecksThis tool overlaps with a bunch of other online site checking tools.
Here's a few that I have used in the past:https://webhint.io/https://pagespeed.web.dev/https://internet.nl/https://www.ssllabs.com/ssltest/https://securityheaders.com/https://csp-evaluator.withgoogle.com/https://observatory.mozilla.org/https://tools.pingdom.com/