ffee
All tools
Security Checklist
Interactive Web App Checklist — computed locally in your browser.
Review your web application
Score: 0%
Passed: 0 of 0
Verdict: —
Failed items
Report
How to use the Security Checklist
- Tick the controls your web application already implements.
- Watch the score, the verdict and the list of failed items update as you go.
- Copy the report and use the outstanding items as your work list.
Features
- Forty five checks across nine security areas
- Live score, pass count and verdict
- Failed items listed as a work list
- Copyable plain text report
Advertisement
Frequently Asked Questions
Common questions about the free online security checklist.
It is a grouped list of controls covering transport, authentication, sessions, input
handling, storage, dependencies, headers, logging and deployment.
Every ticked item counts as one pass and the score is the percentage of all forty five items
that are ticked.
Start with broken authentication, injection flaws and anything that exposes secrets, because
those issues are the most damaging.
Headers such as Content-Security-Policy and X-Content-Type-Options block whole classes of
cross site scripting bugs for very little effort.
Run it before every release and repeat the full review at least once a quarter, or after any
significant architecture change.
No. A checklist removes common mistakes, but you still need threat modelling, testing and
monitoring for your own application logic.
No. The ticks live in the page only and disappear when you reload or close the tab.
Yes. Copy the report and paste the plain text into your ticket, wiki page or security review
document.
A pass is a control you have already implemented and a failed item is one that is still
missing or not yet verified.
Last updated: October 10, 2026