kothariji/ready

ready is a tool for developers to check how production ready their website.

Usage

Install the tool from PyPI with:

pip install ready-check

Running the checks for a domain is as simple as:

ready <domain>

For more, check out --help.

Usage during developer

If you have cloned the repository and would like to run the checks with your local version, simply:

python3 -m ready.ready <domain>

Optional Dependencies

There are no required dependencies, but two optional dependencies that enable some additional behaviour:

Installing the tld package adds support for using the fully-qualified domain name for some DNS-related checks. This is particularly handy if you need to check a subdomain.
Installing beautifulsoup4 adds support for extracting the Content-Security-Policy from the HTML document as well as the headers. This can be used for sites that use static hosting like Github Pages.

Note: if you install from PyPI these dependencies are installed.

Check list

Cookies should set the SameSite flag
Cookies should set the Secure flag
Cookies should set the HttpOnly flag
Swagger URLs should not return 200 (requires --fuzz)
HSTS Header should be included in response
HSTS Header should have a long max-age
HSTS Header should have includeSubdomains
HSTS Header should have preload
An AAAA DNS record exists (IPv6 Support)
HTTP -> HTTPS redirection occurs
Permissions-Policy should exist if the response is HTML
frame-ancestors should be in CSP or X-Frame-Options should exist if the response is HTML
X-Content-Type-options should be "nosniff"
Referrer-Policy should be set
X-XSS-Protection header should not exist
HTML should start with "<!doctype html>"
<html> tag should include lang
HTML should include meta charset tag
HTML should include <title>
HTML should include link with rel="icon"
HTML should not use schemeless urls for links or hrefs
HTML should not use unnecessary HTML entities
All script tags should use subresource integrity
X-DNS-Prefetch-Control should be set to off
CDNs should not be used for Javascript or CSS assets
RSS and JSON feeds should return Access-Control-Allow-Origin header
Cache-Control max-age should be <= 86400 for HTML documents
Content-Security-Policy header should exist
Content-Security-Policy header should start with default-src 'none'
Content-Security-Policy must include either default-src or script-src
Content-Security-Policy header must not include unsafe-inline
Content-Security-Policy header must not include unsafe-eval
Content-Security-Policy header must not include report-sample
Content-Security-Policy header must not include report-uri
Content-Security-Policy header should not include report-to
Content-Security-Policy header should include upgrade-insecure-requests
Content-Security-Policy header only includes valid directives
At least two nameservers should be configured
Cross-Origin-Resource-Policy should be "same-origin"
cross-origin-opener-policy should be "same-origin"
Cross-Origin-Embedder-Policy should be "require-corp"
Report-To Header must not be included in response
Response should not contain hints of a Cloudflare captcha page
Response should not contain hints of a Kasada error page
Response should include a Content-Type
Response should be gzipped
Content-Type header should contain charset
Expires header is deprecated and should not be returned
Cache-Control header should be included in the response
P3P header is deprecated and should not be returned
SPF TXT record should exist
SPF TXT record should contain "-all"
SPF DNS record is depreciated and should not exist
SPF includes use less than 10 DNS requests
DMARC record should exist
DMARC record should contain p=reject
SPF should be "v=spf1 -all" if there are no MX records or MX record is "."
Robots.txt exists and is a text file
Security.txt exists and is a text file that contains required attributes
Favicon is served at /favicon.ico
Headers that leak information should not be in the response
SSL certificate should be trusted
SSL expiry should be less than one year
SSL expiry should be greater than five days
SSL connection fails when using TLS 1.1
SSL connection fails when using TLS 1.0
DNS CAA should be enabled
DNS CAA should include accounturi
DNS CAA should include validationmethods
Response should be a 200 (after redirects)

Potential / WIP

GraphQL introspection is not enabled
DNSSEC is supported
DKIM is configured
SPF must not contain +all or ?all
DMARC / SPF configuration when there is no MX record
CSP should contain default-src or script-src (there's no XSS protection by default)
Detections for different WAFs that might be returning instead of the intended content (Cloudflare, Imperva, Kasada, etc.)
DNS TTL should be > 300, this reduces the number of DNS requests clients need to make
CSP: default-src or script-src must be set
CSP: object-src none must be set
Check for source maps in JS
HTML: contains viewport

Not in scope

Some things are best left to other tools, or are generally handled in other ways by web development teams.

Dependency scanning. Use a service to regularly check that you are using the latest version of your dependencies.
Vulnerability scanning. This tool doesn't replace a penetration test, or automated penetration testing tools.
Scans for specific CMSs (i.e. Wordpress, Drupal, etc.). You know what CMS you are using, and you should run framework/cms specific tools in addition to this.
Checking for dead links. Use muffet or similar for that one.
Scans for specific WAFs (use wafw00f for detection)

Standard Checks

This tool overlaps with a bunch of other online site checking tool. I use these ones on a regular basis (and recommend them):

https://webhint.io/
https://pagespeed.web.dev/
https://internet.nl/
https://www.ssllabs.com/ssltest/
https://securityheaders.com/
https://csp-evaluator.withgoogle.com/
https://observatory.mozilla.org/
https://screenshots.page/ (IPv6 screenshots)
https://tools.pingdom.com/
https://github.com/raviqqe/muffet (Dead Links)

kothariji / ready