VibeCheck · website security header check
Free website security check for shipped-fast projects
AI-generated sites ship functional code with default configuration. That usually means no security headers, no HSTS, and sometimes a service key sitting in the client bundle.
No signup · Results in ~10 seconds · Public pages only
What this scan checks
Transport
HTTPS redirect, valid certificate chain and HSTS with a sane max-age.
Headers
CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
Secret leakage
Service keys, private tokens and admin endpoints reachable from the browser.
Mixed content
Insecure scripts, images and iframes loaded on secure pages.
In short
VibeCheck's security check inspects HTTPS enforcement, HSTS, Content-Security-Policy, X-Frame-Options, referrer and permissions policies, mixed content, cookie flags and client-side exposed API keys. Security is the heaviest category at 20% of the total score.
- Security is weighted at 20% — the largest single category in the score
- Findings include the exact header value observed on your site
- Yunitelabs can implement the hardening for you from the same report
Questions we get asked
Is this a penetration test?
No. VibeCheck is a non-intrusive configuration audit of publicly observable signals. It never attacks or logs into your site.
Do you store my site's data?
Only the findings needed to render your report — evidence snippets are truncated and no credentials are ever collected.
Other VibeCheck audits
Free website audit tool that actually tells you what to fix
free website audit tool
Free technical SEO audit with fixes, not just warnings
free SEO audit
GEO audit: can AI answer engines actually quote your site?
GEO audit for AI search
Pre-launch audit for sites built with Lovable
audit a Lovable site before launch
Get your score, then get the fixes.
- Free 0-100 production readiness score
- Your five biggest issues with evidence
- AI fix prompts for Lovable, Cursor, Claude Code and ChatGPT
- Free re-scan to prove the score moved
No signup · Results in ~10 seconds · Public pages only