Site security
A score out of 100 and the list of what to fix, assembled from the checks that run on every deployment — headers, exposed files, secrets, cookies, redirects, third-party scripts, TLS.
Pro plan and aboveUpdated on 17 September 2026
On this page
Six checks already look at the site's security on every deployment, each on its own line in Site checks. The Security page (Project → Quality → Security) reads them together: a score, three lists from the most serious to the most cosmetic, one fix per finding, the headers as the server serves them, and the score over time. Nothing new is probed: what changes is the reading.
What PostShip does
Where the findings come from
| Piece | Check | What is read |
|---|---|---|
| Headers and mixed content | Security headers | HSTS, clickjacking, nosniff, CSP, Referrer-Policy, Permissions-Policy, chatty server, http resources |
| Exposed files | Exposed files | .env, .git, backups, phpinfo, .htpasswd, server-status, an over-talkative robots.txt |
| Secrets in the page | Leaks | a secret key served in the HTML, a localhost address |
| Cookies | Cookies and consent | Secure, HttpOnly on the session, SameSite |
| Redirects | Redirects check | a site on http, http not redirecting to https |
| Third-party scripts | Third-party scripts | a script without an integrity attribute, a script changed at the provider |
| TLS | Domains and certificates | TLS 1.0/1.1 still accepted, expired certificate |
The score
Three severities. Blocking (25 points): an open door, to close today — a readable .env, a downloadable .git, a secret in the page, a site on http, an expired certificate. To fix (10 points): a known protection that is missing and that a documented attack exploits — HSTS, clickjacking protection, nosniff, cookies without Secure or a session without HttpOnly, http not redirected, downloadable backup, old TLS. Hardening (3 points): what a serious site has, but whose absence is the norm on half the web — CSP, Referrer-Policy, Permissions-Policy, SameSite, server version, .DS_Store.
The score starts at 100 and removes each finding's points, floor zero. The letter reads at a glance: A from 90, B from 75, C from 60, D from 40, F below — and F as soon as a finding is blocking, whatever the score: an open door is not offset by good headers.
The fix
Each finding comes with what to do, in one sentence, with the exact header or attribute: Strict-Transport-Security: max-age=31536000; includeSubDomains, frame-ancestors 'none', SameSite=Lax… When the check knows where (the exposed file's path, the cookie names, the http resources), the page says so.
Over time
The score is recomputed at each pass of the headers check, with the last known pass of every other check, over sixty days: one bar per pass. A redesign that loses HSTS shows on the next bar.
Settings
Nothing to set. The checks are set up on the first checked deployment; “Re-run the checks” runs them right away, all six, without waiting for a deployment (at most once a minute). A check turned off in Site checks no longer counts in the score.
What triggers an alert
No new alert: these are the checks' own alerts, on deployment, under the “Deployment quality” type of your channels. The page is there to read, prioritise and fix.
Limits and plans
| Free | Pro | Team | Agency | |
|---|---|---|---|---|
| The score and the number of findings | Yes | Yes | Yes | Yes |
| The detail, the fixes, the headers, the curve, “Re-run” | — | Yes | Yes | Yes |
See plans.
Troubleshooting
“Not measured yet”
The checks run on deployment: without a connected host or a detected deployment, they have not run yet. “Re-run the checks” starts them by hand.
The score drops without a deployment
A cookie set by a third-party script, a script provider changing its file, a certificate expiring: the score reads the world as it is on the last pass, not only what you deployed.
A “To fix” finding I cannot fix
A header is set at the host (Vercel, Netlify, Cloudflare have a headers configuration) or in the server; if neither is in your hands, the finding stays, and it is honest information about the site.