A developer-friendly web scanning tool

Navigation

Verified details

These details have been verified by PyPI
Project links
GitHub Statistics
Maintainers
Avatar for brntn from gravatar.com brntn

Unverified details

These details have not been verified by PyPI
Meta
Classifiers
Report project as malware

Project description

🚀 ready is a tool for developers to check how production ready their website.

Usage

Install the tool from PyPI with:

pip install ready-check

Running the checks for a domain is as simple as:

ready <domain>

For more options, check the output of --help.

Usage during development

If you have cloned the repository and would like to run the checks with your local version, simply run:

python3 -m ready.ready <domain> [--request-filter=<x>] [--check-filter=<x>]

Optional Dependencies

There are no required dependencies, but two optional dependencies that enable some additional behaviour:

  • Installing the tld package adds support for using the fully-qualified domain name for some DNS-related checks. This is handy if you want to check a subdomain.
  • Installing beautifulsoup4 adds support for extracting some headers from the HTML document as well as the headers. This technique can be used for sites that use static hosting like Github Pages.

Note: if you install from PyPI these dependencies are installed.

Check list

  • Cookies should set the SameSite flag
  • Cookies should set the Secure flag
  • Cookies should set the HttpOnly flag
  • Swagger URLs should not return 200 (requires --fuzz)
  • HSTS Header should be included in response
  • HSTS Header should have a long max-age
  • HSTS Header should have includeSubdomains
  • HSTS Header should have preload
  • An AAAA DNS record exists (IPv6 Support)
  • HTTP -> HTTPS redirection occurs
  • Permissions-Policy should exist if the response is HTML
  • frame-ancestors should be in CSP or X-Frame-Options should exist if the response is HTML
  • X-Content-Type-options should be "nosniff"
  • Referrer-Policy should be set
  • X-XSS-Protection header should not exist
  • HTML should start with "<!doctype html>"
  • <html> tag should include lang
  • HTML should include meta charset tag
  • HTML should include <title>
  • HTML should include link with rel="icon"
  • HTML should not use schemeless urls for links or hrefs
  • HTML should not use unnecessary HTML entities
  • All script tags should use subresource integrity
  • X-DNS-Prefetch-Control should be set to off
  • CDNs should not be used for Javascript or CSS assets
  • RSS and JSON feeds should return Access-Control-Allow-Origin header
  • Cache-Control max-age should be <= 86400 for HTML documents
  • Content-Security-Policy header should exist
  • Content-Security-Policy header should start with default-src 'none'
  • Content-Security-Policy must include either default-src or script-src
  • Content-Security-Policy header must not include unsafe-inline
  • Content-Security-Policy header must not include unsafe-eval
  • Content-Security-Policy header must not include report-sample
  • Content-Security-Policy header must not include report-uri
  • Content-Security-Policy header should not include report-to
  • Content-Security-Policy header should include upgrade-insecure-requests
  • Content-Security-Policy header only includes valid directives
  • At least two nameservers should be configured
  • Cross-Origin-Resource-Policy should be "same-origin"
  • cross-origin-opener-policy should be "same-origin"
  • Cross-Origin-Embedder-Policy should be "require-corp"
  • Report-To Header must not be included in response
  • Response should not contain hints of a Cloudflare captcha page
  • Response should not contain hints of a Kasada error page
  • Response should include a Content-Type
  • Response should be gzipped
  • Content-Type header should contain charset
  • Expires header should not be used without Cache-Control
  • Cache-Control header should be included in the response
  • P3P header is deprecated and should not be returned
  • SPF TXT record should exist
  • SPF TXT record should contain "-all"
  • SPF DNS record is deprecated and should not exist
  • SPF includes use less than 10 DNS requests
  • DMARC record should exist
  • DMARC record should contain p=reject
  • SPF should be "v=spf1 -all" if there are no MX records or MX record is "."
  • Robots.txt exists and is a text file
  • Security.txt exists and is a text file that contains required attributes
  • Security.txt has an expiry date in the future
  • Favicon is served at /favicon.ico
  • Headers that leak information should not be in the response
  • SSL certificate should be trusted
  • SSL expiry should be less than one year
  • SSL expiry should be greater than five days
  • SSL connection fails when using TLS 1.1
  • SSL connection fails when using TLS 1.0
  • DNS CAA should be enabled
  • DNS CAA should include accounturi
  • DNS CAA should include validationmethods
  • SSL certificate must provide OCSP URI
  • SSL certificate should provide OCSP must-staple
  • Response should be a 200 (after redirects)

Other Tools

This tool overlaps with a bunch of other online site checking tools. Here's a few that I have used in the past:

Project details

Verified details

These details have been verified by PyPI
Project links
GitHub Statistics
Maintainers
Avatar for brntn from gravatar.com brntn

Unverified details

These details have not been verified by PyPI
Meta
Classifiers

Release history Release notifications | RSS feed

This version

1.7.0

1.6.1

1.5.0

1.4.0

1.3.0

1.2.7

1.2.6

1.2.5

1.2.4

1.2.3

1.2.2

1.2.1

1.2.0

1.1.1

1.1.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ready_check-1.7.0.tar.gz (34.7 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

ready_check-1.7.0-py3-none-any.whl (27.8 kB view details)

Uploaded Python 3

File details

Details for the file ready_check-1.7.0.tar.gz.

File metadata

  • Download URL: ready_check-1.7.0.tar.gz
  • Upload date:
  • Size: 34.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for ready_check-1.7.0.tar.gz
Algorithm Hash digest
SHA256 37736d7802dab227e6e3494b5b6c657fd8df7ea5457efacb3573011aca1ce990
MD5 c87e30bb1686a469bcfe1c93941a0df9
BLAKE2b-256 f955e0874f03cda716e5064a316bca3a3d235a55441daf353b9b338bb429e76a

See more details on using hashes here.

Provenance

The following attestation bundles were made for ready_check-1.7.0.tar.gz:

Publisher: publish.yml on sesh/ready

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file ready_check-1.7.0-py3-none-any.whl.

File metadata

  • Download URL: ready_check-1.7.0-py3-none-any.whl
  • Upload date:
  • Size: 27.8 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for ready_check-1.7.0-py3-none-any.whl
Algorithm Hash digest
SHA256 00289fbbb1d74d55164dee83233c7416a82d9c28310aa9f7fc2897e38abafa75
MD5 601d2234790f229ce87bad27322d769e
BLAKE2b-256 0d1fd944c39056c5e2f2e266eae1c1491717605329ca5bb8d93b3f0813679de5

See more details on using hashes here.

Provenance

The following attestation bundles were made for ready_check-1.7.0-py3-none-any.whl:

Publisher: publish.yml on sesh/ready

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page