Obvious web security: HSTS, clickjacking, HTTPS redirects
You do not need a full pen-test to catch the basics. CrowWake looks for the public, obvious mistakes that still cause real incidents.
US search interest: “hsts” ~5.4k/mo · “x-frame-options” ~880/mo with very high CPC (DataForSEO)—operators pay attention here.
What CrowWake checks
HTTPS response headers: Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors. Whether HTTP redirects cleanly to HTTPS. Fast TCP probes for risky services (FTP, Telnet, MySQL, Postgres, Redis, MongoDB) left open on the public hostname.
Why it matters
HSTS tells browsers “only use HTTPS here,” cutting downgrade attacks. Framing headers stop simple clickjacking. Open databases on the public IP are the kind of mistake that makes headlines—and your probe mesh can notice them early.
What “good enough” looks like
HTTPS everywhere with a redirect. HSTS enabled (once you are sure HTTPS is solid). Clickjacking protections on app pages. No accidental database ports on the edge.
If CrowWake crows
Add the missing headers at the web server or CDN. Fix HTTP→HTTPS redirects. Close or firewall risky ports. These are best-effort public checks—not a guarantee of security.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.