Hyperion / Insights / Checking a website's security
Security · Websites

How to check the security of a website

Hyperion · 3 November 2026 · 5-minute read

A website can work perfectly well and still be exposed: a badly configured certificate, a missing header, a file forgotten on the server. These are problems that can be seen from the outside in a few minutes, if you know where to look. Here is what to check, how to read the result and what an automated check cannot tell you.

In brief

  • Four areas: HTTPS and certificate, HTTP security headers, known vulnerabilities and exposed files, application behaviour.
  • Authorised websites only: an active check sends test requests; run it on your own websites or with written authorisation.
  • The result is read with CVSS: each problem has a severity from 0 to 10 and a fix.
  • With Tessera, Hyperion's service, the check is automated and the report arrives in a few minutes, in Italian or English.

What to check

1. HTTPS and certificate

Which protocols the server offers (old versions of SSL and TLS should be switched off), which ciphers, whether the certificate chain is complete and when it expires, whether the server is exposed to known TLS vulnerabilities such as Heartbleed or POODLE. And whether the website also responds over HTTP without redirecting to HTTPS.

2. HTTP security headers

Instructions the server sends to the browser: Strict-Transport-Security enforces HTTPS, Content-Security-Policy restricts scripts, X-Frame-Options prevents the website from being framed by another, X-Content-Type-Options blocks files being interpreted the wrong way. When they are missing, the website is more exposed. Tessera has a guide to security headers with the configuration for nginx, Apache and Express.

3. Known vulnerabilities and exposed files

Configuration or backup files reachable from the web, configuration errors, default credentials, software with published vulnerabilities. These are the first checks anyone looking for a weak point will make.

4. The application

How the website behaves while you browse it: cookies without the HttpOnly or SameSite attributes, sensitive content stored in the cache, information left in code comments, headers that reveal the technology used, such as X-Powered-By.

Before you start

  • Authorisation: only check websites that are yours or for which you have written permission. An active scan is not a simple visit.
  • Warnings: the scan sends many requests in a short time and can trigger alarms or the web application firewall. If a supplier manages the website, let them know.
  • Timing: ideally after a release or a change to the server, and then regularly.

How to read the result

Each problem found has a CVSS v3.1 score, the FIRST standard that measures severity from 0 to 10 (FIRST). In Tessera's report the score becomes a risk level:

LevelCVSSWhat to do
High7.0 – 10.0Fix immediately
Medium4.0 – 6.9Plan the fix soon
Low0.1 – 3.9Fix at the first opportunity
Informational—Worth knowing, not a flaw

The problems add up to a security score from 0 to 100, with a grade from A (Excellent) to F (Critical). A single High-level problem is enough to keep the website below 50 (Tessera methodology).

How Tessera does it

Tessera is Hyperion's service that runs an automated security check on a website, the Quick Check, with nothing to install. It is designed for people who manage a website and do not have a security team.

  1. You verify the domain with a DNS record or a file published on the website: Tessera only checks websites you are authorised to test.
  2. The check starts, with four tools: HTTP headers, TLS with testssl.sh, known vulnerabilities with Nuclei, application scan with OWASP ZAP.
  3. You receive the report in a few minutes, as a PDF and a web page, in Italian or English: a score from 0 to 100, a grade from A to F, CVSS and a recommendation for each problem, fix priorities.

The report can only be accessed through a signed link valid for 7 days. The application and the report archive are on Microsoft Azure, in the Italy North region. There is a one-off check and a monthly check of a website. Before you start you can look at the sample report (PDF).

Want to know how your website stands? Run the Quick Check with Tessera: a report in a few minutes, with fixes in order of priority.

What an automated check does not cover

A scan from the outside quickly finds common problems, but it does not replace a penetration test. It does not go into areas protected by a login, does not test the application's logic or the permissions between roles, does not read the source code, does not see infrastructure that is not exposed and does not confirm the results by hand. To understand when you need one and when the other, see the guide Penetration test or automated scan.

Frequently asked questions

How do I know whether my website is secure?

Four areas are checked from the outside: the HTTPS and certificate configuration, the HTTP security headers, known vulnerabilities and exposed files, and the behaviour of the application, for example cookies. An automated check such as Tessera's Quick Check verifies them in a few minutes and returns a report with a score and the fixes to make.

Can I check any website?

No. An active check sends test requests and must only be run on your own websites or those for which you have written authorisation. Tessera asks you to prove control of the domain before the first scan, with a DNS record or a file published on the website.

Is an automated check a penetration test?

No. An automated scan works from the outside, without credentials and without manual verification of the results. A penetration test is carried out by specialists, also goes into restricted areas and tests the application's logic. The scan is for finding common problems quickly; the penetration test goes deeper.

What is the CVSS score?

It is FIRST's CVSS v3.1 standard, which rates the severity of a vulnerability on a scale from 0 to 10. In Tessera's report the levels are derived from that score: High from 7.0 to 10.0, Medium from 4.0 to 6.9, Low from 0.1 to 3.9.

Can the check slow down the website?

The traffic is limited, but an active scan generates many requests in a short time and can trigger the website's alarms. If the website is fragile or protected by a web application firewall, it is best to warn whoever manages it beforehand.

How often should the check be repeated?

After every significant change to the website or server, and in any case regularly, because new vulnerabilities are published all the time. Tessera offers both a one-off check and a monthly check of a website.

Sources