Guide
How to do a security audit on your website
To audit your website's security, check five things in order: exposed keys in the browser, a database readable without a login, missing security headers, leaked source or config, and disclosed versions. Each is visible from your live URL, so a first-pass audit takes minutes with a passive scanner and no access to your code.
The audit checklist
- Keys — is a secret key in the shipped JavaScript.
- Database — can anyone read it without logging in.
- Headers — are the security headers set.
- Leaks — is a .env or a source map public.
- Disclosure — are server versions or directory listings exposed.
A first-pass audit takes minutes, from the outside, with no access to your code.
Run it from the outside first
The fastest audit checks what the deployed site actually exposes, because that is what an attacker sees. Plaintext runs this pass automatically against your live URL and reports the findings worst first, each with a fix. Start there, then dig into anything it flags.
Frequently asked
How do I audit my website for security?
Check for exposed keys, an open database, missing security headers, leaked source or config, and disclosed versions. Each is visible from your live URL. A passive scanner runs the first pass in minutes and lists issues worst first.
Can I do a security audit myself?
Yes, for the common issues. A passive scan of your live URL surfaces exposed keys, open databases, missing headers, and leaked internals without needing your code. Deeper logic review is where a manual or professional audit adds value.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes AI code generators leave open. The first scan is free.
Scan my app