Obvious web security: HSTS, clickjacking, HTTPS redirects, open ports
You do not need a full pen-test to catch the basics. CrowWake looks for the public, obvious mistakes that still cause real incidents.
What CrowWake checks
HTTPS response headers: Strict-Transport-Security (HSTS), X-Content-Type-Options (nosniff), X-Frame-Options or CSP frame-ancestors. Whether HTTP redirects cleanly to HTTPS. Fast TCP probes for risky services (FTP, Telnet, MySQL, Postgres, Redis, MongoDB) left open on the public hostname. The free security headers checker and free open port scanner use the same signals with no login. For the repeat “watch these headers hourly” job, see the dedicated security headers monitoring guide.
Why it matters
HSTS tells browsers “only use HTTPS here,” cutting downgrade attacks—see the dedicated HSTS guide for max-age, includeSubDomains, and preload. Framing headers stop simple clickjacking—see the X-Frame-Options guide for DENY / SAMEORIGIN vs CSP frame-ancestors. X-Content-Type-Options: nosniff stops MIME sniffing—see the dedicated XCTO guide. HTTP that still serves the site without an HTTPS redirect leaves a cleartext door open—see the HTTPS redirect guide. Open databases on the public IP are the kind of mistake that makes headlines—see the dedicated open ports guide. Operators hunting an open port scanner usually want that early rooster, not a full network sweep.
What “good enough” looks like
HTTPS everywhere with a redirect. HSTS enabled (once you are sure HTTPS is solid). Clickjacking protections on app pages (X-Frame-Options or CSP frame-ancestors). X-Content-Type-Options: nosniff on responses. No accidental FTP, Telnet, or database/cache ports on the edge—bind those to private networks or firewall them (open ports guide).
Quick triage for open ports
1) Run the free open port scanner and note any ftp:21, telnet:23, mysql:3306, postgres:5432, redis:6379, or mongodb:27017 hits. 2) Confirm whether the hostname points at a shared host, VPS, or CDN edge (false positives are rare for these ports, but shared hosting can surprise you). 3) Close the service or firewall it to trusted IPs. 4) Re-run the scanner, then add the domain so CrowWake crows if a port reappears after a rebuild. Full plain-English walkthrough: open ports guide.
If CrowWake crows
Add the missing headers at the web server or CDN. Fix HTTP→HTTPS redirects. Close or firewall risky ports. These are best-effort public checks—not a guarantee of security. For HSTS alone (max-age, includeSubDomains, preload), see the HSTS guide. For framing / clickjacking, see the X-Frame-Options guide. For MIME sniffing / nosniff, see the X-Content-Type-Options guide. For cleartext HTTP that never jumps to HTTPS, see the HTTPS redirect guide. For FTP/DB/cache ports on the public hostname, see the open ports guide. For the hourly security headers monitoring framing, see the dedicated guide.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free Security checker with no login.
Deep dive: Security headers monitoring — watch HSTS, nosniff, framing, and HTTPS redirect so a silent CDN wipe crows early.
Deep dive: What is HSTS? — max-age, includeSubDomains, and preload.
Deep dive: What is X-Frame-Options? — DENY / SAMEORIGIN vs CSP frame-ancestors.
Deep dive: Missing X-Content-Type-Options header — nosniff and how to fix it.
Deep dive: HTTP→HTTPS redirect — force HTTPS before you raise HSTS.
Deep dive: Open ports / open port scanner — FTP, Telnet, MySQL, Postgres, Redis, MongoDB on the public hostname.
Also: free open port scanner for the same risky ports CrowWake watches hourly.