Check your websites' security settings every week
Each Monday, checks the sites you list for the browser protections they should switch on, and emails what is missing and how to fix it.
What it does
Each integration step this workflow runs, in order, what it is for, and the conditions and loops that decide when it runs.
- 1OpenAIQuery modelAsks the AI to explain what each missing header does and the change to make on your web server or CDN.
- 2GmailSendEmails you the write-up and the raw readings for every site, with a subject giving how many sites have gaps.
How it works
What happens on each run, in plain English.
Every Monday at 08:00, each website you list gets one ordinary page request, exactly what a visitor's browser makes, and only that response is read. Nothing is probed, no paths are guessed and no address other than the ones you list is contacted, so it is a passive check of sites you own, not a scanner.
The email you get names, for each site, which of Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy are missing, whether a visitor arriving over plain http is sent on to https, and the server banner verbatim. AI then explains what each missing header does and the change to make in your web server or CDN, and is told not to judge how exploitable anything is or invent findings. The readings go out even if the write-up fails. A site that cannot be reached is listed separately with the reason and never stops the rest being checked.
Put only sites you are responsible for in the list, since each one is requested every week.
You may also be interested in
Flag emails that link to unfamiliar websitesPosts to Slack when new mail links to a site outside your expected list, with how recently that site was registered and who runs it.
Turn reported suspicious mail into Jira ticketsOpens a Jira ticket for each message your people report, and adds later reports of the same sender to the ticket already open.
Record where incoming emails really came fromFor the emails your Gmail search picks out, logs whether each passed the sender checks and which servers it really came through.Watch your websites for downtimeChecks every site listed in a spreadsheet on a schedule and alerts you in Slack or by email when one goes down or recovers.Start from a workflow that already works.
Add "Check your websites' security settings every week" to your workspace, connect its apps, and make it yours.
Free plan, no credit card