I scanned my own sites for security issues. Here’s the checklist I wish I’d had.

I've been working on a website scanner for personal projects, and so I scanned my own sites first. The results were sobering. The issues weren't exotic; they were simple fixes that most sites overlook. Here's the checklist I now run on every website I deploy:

1. Implement security headers. Most of the sites I tested lacked at least one crucial header. These include Strict-Transport-Security (HSTS) to force HTTPS, Content-Security-Policy (CSP) to limit script sources, X-Content-Type-Options: nosniff to prevent browsers from guessing file types, X-Frame-Options / frame-ancestors to block embedding for clickjacking, and Referrer-Policy to control how much URL data leaks.

2. Fix mixed content. If your site is HTTPS, ensure none of your resources - like images or scripts - are still loading over HTTP. HTTP mixed content can be blocked by browsers or trigger warnings.

3. Remove exposed files. Check your domain for files you shouldn't be publicly accessible, like /.git/, /.env/, /backup.zip, or /db.sql. If any return something other than a 404, you have a serious problem. Leaked .env files often contain API keys, which are common targets for theft.

4. Update outdated libraries. Using legacy versions like an old jQuery or Bootstrap from 2018 might expose you to known vulnerabilities. Make sure you're serving the latest versions of everything - not just what you see in your package.json.

5. Security and performance go hand-in-hand. Sluggish, bloated pages with numerous third-party scripts increase your risk. Audit all scripts and eliminate what you don't need.

The reason I built a tool for this process is that checking all of these items manually for each project became tedious. So I created PerfoMetrix, a service that checks both security and performance in a single report when given a URL. There's a free tier, so you can run it on any site without needing a paid subscription. As I've been building this solo, I'd love to hear your feedback: What's the one check you wish a scanner like this would run that most tools overlook? Let me know in the comments below.