ThinkCodec Start a project
ThinkCodec
Start a project

Based in Dallas-Fort Worth.
We work anywhere.
A ThinkCodec sample. Cedar Thread Tailoring is a made-up business.

Before a website goes live

Website
launch check

We check the pages and browser settings, fix what fails, then run the same check again.

Here is what changed on Cedar Thread Tailoring's four-page website.

Compare the builds

First build

2 of 12checks passed

Launch build

12 of 12checks passed
Cedar Thread TailoringHome
Cedar Thread website with alterations, fitting requests and a privacy link
The site we checked. Home, services, contact and privacy.

The same check, twice

Before and after results

4 pages checked in each build

We ran this check on a local copy of the site. Browsers start following the HTTPS setting once the site is live on HTTPS.

Measured checks for First build and Launch build
What we checkFirst buildLaunch build
HTTPS preferenceStrict-Transport-Security

Asks browsers to use HTTPS on future visits.

What we changed

Added the header that tells browsers to use HTTPS.

Fail

The header is missing on all 4 pages.

Raw output
Not sent on any of the 4 pages.
Pass

All 4 pages send the HTTPS setting.

Raw output
max-age=31536000 · sent on all 4 pages.
Allowed files and framesContent-Security-Policy

Limits loaded files and which pages may embed this site.

What we changed

Allowed only the site's own files, turned off form sending and stopped other sites from framing it.

Fail

The header is missing on all 4 pages.

Raw output
Not sent on any of the 4 pages.
Pass

All 4 pages send a policy allowing only this site's files and blocking form sending and framing.

Raw output
default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none' · sent on all 4 pages.
Declared file typesX-Content-Type-Options

Stops browsers guessing a different file type.

What we changed

Added nosniff and served files with the right content type.

Fail

The header is missing on all 4 pages.

Raw output
Not sent on any of the 4 pages.
Pass

All 4 pages send the setting to respect declared file types.

Raw output
nosniff · sent on all 4 pages.
Referrer informationReferrer-Policy

Keeps the referring page address out of outgoing requests.

What we changed

Set no-referrer on every page.

Fail

The header is missing on all 4 pages.

Raw output
Not sent on any of the 4 pages.
Pass

All 4 pages send the setting to leave out referrer information.

Raw output
no-referrer · sent on all 4 pages.
Camera, microphone and locationPermissions-Policy

Turns off browser features this site does not need.

What we changed

Denied camera, microphone and location access.

Fail

The header is missing on all 4 pages.

Raw output
Not sent on any of the 4 pages.
Pass

All 4 pages send the setting to turn off camera, microphone and location.

Raw output
camera=(), microphone=(), geolocation=() · sent on all 4 pages.
Page framingX-Frame-Options

Stops other sites from showing this site inside a frame to trick visitors into clicking.

What we changed

Blocked framing for older browsers too.

Fail

The header is missing on all 4 pages.

Raw output
Not sent on any of the 4 pages.
Pass

All 4 pages send the setting to block framing.

Raw output
DENY · sent on all 4 pages.
Mixed contentPage resources

Loads every file over HTTPS, so nobody can read or change it on the way.

What we changed

Removed the plain HTTP image reference.

Fail

A plain HTTP image was found on 1 of 4 pages. Our test blocked it before fetching.

Raw output
home: img[src] http://cdn.example.com/storefront.jpg; home: request http://cdn.example.com/storefront.jpg
Pass

No plain HTTP files were found on any of the 4 pages.

Raw output
No plain HTTP resource references on any of the 4 pages.
Form spam trapContact form

Checks that the form has a hidden field that catches spam bots.

What we changed

Added the hidden website field. Sending stays turned off.

Fail

0 of 1 forms have the hidden spam-trap field.

Raw output
0 of 1 forms have a hidden website field outside the tab order.
Pass

1 of 1 forms have the hidden spam-trap field.

Raw output
1 of 1 forms have a hidden website field outside the tab order.
Form destinationContact form

Checks where the form would send an entry.

What we changed

Kept the form disabled with no delivery service.

Pass

Form sending is turned off, and the local server rejects submissions.

Raw output
contact: action="#", method="post", submit disabled; local server rejects POST with 405.
Pass

Form sending is turned off, and the local server rejects submissions.

Raw output
contact: action="#", method="post", submit disabled; local server rejects POST with 405.
Third-party scriptsScript sources

Checks that any script loaded from another site carries a fingerprint proving it wasn't changed.

What we changed

Kept outside scripts off the site.

Pass

No third-party scripts on any of the 4 pages.

Raw output
No third-party scripts on any of the 4 pages.
Pass

No third-party scripts on any of the 4 pages.

Raw output
No third-party scripts on any of the 4 pages.
Privacy linkPage footers

Makes the privacy page easy to find.

What we changed

Linked the existing privacy page from every footer.

Fail

0 of 4 page footers link to the privacy page.

Raw output
0 of 4 page footers link to the privacy page.
Pass

4 of 4 page footers link to the privacy page.

Raw output
4 of 4 page footers link to the privacy page.
Browser consoleFour page visits

Checks for browser errors while the pages load.

What we changed

Removed the stale gallery script link.

Fail

A missing gallery script on all 4 pages, and our test blocking the plain HTTP image.

Raw output
home: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT.Inspector; home: Failed to load resource: the server responded with a status of 404 (Not Found); services: Failed to load resource: the server responded with a status of 404 (Not Found); contact: Failed to load resource: the server responded with a status of 404 (Not Found); privacy: Failed to load resource: the server responded with a status of 404 (Not Found)
Pass

No browser errors on any of the 4 pages.

Raw output
No console errors or uncaught exceptions across all 4 pages.

At launch

Your check results to keep

You get the results file and a one-page summary of what we checked, what changed and what still needs attention.

Read our website security checklist
JSONResults fileEvery check and its measured evidenceHTMLOne-page summaryRead it here or print a copy

Sources

Fictional Cedar Thread Tailoring website. A ThinkCodec sample.