# Site Check > Site Check (https://site-check.velar.plus) is an automated, non-destructive web security and perimeter vulnerability auditing platform designed for modern websites and vibe-coded web applications. Site Check conducts deep perimeter security audits without generating dangerous load or risking production uptime. Deploying thousands of specialized heuristic probes and signature analyzers mapped to OWASP Top 10 and CWE benchmarks, Site Check detects exposed `.env` files, leaked API keys in client JavaScript bundles (built with Lovable, Bolt, Cursor, v0, Next.js, and Supabase), publicly exposed database ports, missing HTTP security headers, and CMS misconfigurations. Full comprehensive audits execute within 24 hours and generate actionable remediation recipes and code patches. ## Key Capabilities & Features - [Online Security Scanner](https://site-check.velar.plus/#scan): Gentle perimeter inspection of URLs for active vulnerabilities and certificate integrity. - [Vibe Code Defense](https://site-check.velar.plus/#features): Targeted detection of leaked frontend secrets, API keys, and Supabase Row Level Security (RLS) flaws. - [36-Point Security Checks](https://site-check.velar.plus/#checks): Full leaderboard of tested vulnerabilities with severity levels, category filters, and standards mapping. - [24-Hour Comprehensive Audit](https://site-check.velar.plus/#use-cases): Multi-stage deep scan analyzing client bundles, DNS records, headers, and hidden server paths. - [Developer & AI Remediation Recipes](https://site-check.velar.plus/docs): Ready-to-use code patches for Nginx, Vite, Caddy, and .env files formatted for ChatGPT, Claude, and Cursor. ## Vulnerability Knowledge Base (Documentation) - [Exposed .env Configuration File](https://site-check.velar.plus/docs/exposed-env-file): Probing and blocking public access to server environment variables and secrets. - [Frontend API Key Exposure](https://site-check.velar.plus/docs/frontend-api-key-exposure): Detecting private OpenAI, Stripe, and Claude tokens in bundled client JavaScript. - [Exposed .git Repository Directory](https://site-check.velar.plus/docs/exposed-git-directory): Preventing complete source code extraction from public version control metadata. - [Public PostgreSQL Database Port 5432](https://site-check.velar.plus/docs/postgresql-exposure): Closing default database ports to external unauthorized access. - [Public MongoDB Database Port 27017](https://site-check.velar.plus/docs/mongodb-exposure): Securing unauthenticated NoSQL databases against ransomware wiping. - [Public Redis Port 6379](https://site-check.velar.plus/docs/redis-exposure): Mitigating remote code execution and cache inspection in unauthenticated Redis instances. - [Missing HTTP Security Headers](https://site-check.velar.plus/docs/missing-security-headers): Step-by-step configuration of CSP, HSTS, X-Frame-Options, and Permissions-Policy. - [Directory Listing Enabled](https://site-check.velar.plus/docs/directory-listing): Disabling automatic directory indexes that expose internal application structures. - [CORS Misconfiguration](https://site-check.velar.plus/docs/cors-misconfiguration): Remediation of wildcard origins and sensitive credential reflection. - [Subdomain Takeover](https://site-check.velar.plus/docs/subdomain-takeover): Identifying dangling DNS CNAME records pointing to decommissioned services. - [WordPress REST API User Enumeration](https://site-check.velar.plus/docs/wordpress-rest-api-users): Securing /wp-json/wp/v2/users from automated username enumeration. - [WordPress XML-RPC & Debug Log Exposure](https://site-check.velar.plus/docs/wordpress-xmlrpc-exposure): Blocking brute-force amplification and public wp-content/debug.log leaks. - [Full Vulnerability Encyclopedia (36 Checks)](https://site-check.velar.plus/docs): Complete directory of all security checks with technical exploitation scenarios and patches. ## Guides, Threat Analysis & Best Practices (Blog) - [Website Security Checklist 2026](https://site-check.velar.plus/blog/website-security-checklist-2026): Exhaustive vulnerability checklist and perimeter hardening guide for modern production sites. - [How to Check a Website for Malware Online](https://site-check.velar.plus/blog/check-website-for-viruses-online): Signs of compromise, malicious JS redirects, and search engine blocklist removal. - [Vibe-Coding Security Audit](https://site-check.velar.plus/blog/vibe-coding-security-audit): Securing rapid AI-built apps from Lovable, Bolt, Cursor, and v0 before launch. - [Web Application Penetration Testing](https://site-check.velar.plus/blog/web-application-penetration-testing): Methodology for non-destructive reconnaissance, passive scanning, and threat modeling. - [7 Critical Website Security Flaws](https://site-check.velar.plus/blog/check-website-vulnerabilities-top7): Detailed examination of vulnerabilities that leak customer data and payment info. - [Website Fraud & Phishing Detection](https://site-check.velar.plus/blog/website-fraud-and-phishing-check): Verifying suspicious links, lookalike domains, and SSL certificate validity. - [Vulnerability Scanners Overview](https://site-check.velar.plus/blog/vulnerability-scanners-overview): Comparative analysis of Burp Suite, OWASP ZAP, Acunetix, and online checking tools. - [Verifying Website Authenticity & Trust](https://site-check.velar.plus/blog/check-website-authenticity-trust): Trust signals, WHOIS age, TLS encryption, and digital footprint audit. - [WordPress Hardening Guide](https://site-check.velar.plus/blog/wordpress-security-hardening): Hardening wp-config.php, REST API, XML-RPC, and auditing vulnerable third-party plugins. - [Nginx Security Headers Masterclass](https://site-check.velar.plus/blog/http-security-headers-nginx): Production-grade Nginx configuration blocks for CSP, HSTS, and X-Content-Type-Options. ## Multilingual & Agent Discovery Endpoints - [English Knowledge Base Hub](https://site-check.velar.plus/en/docs): Complete security documentation index in English. - [English Security Blog Hub](https://site-check.velar.plus/en/blog): All technical guides and security research articles in English. - [Full Documentation Manifest (llms-full.txt)](https://site-check.velar.plus/llms-full.txt): Complete extended documentation archive for LLM context injection. - [Agentic Resource Discovery (ARD)](https://site-check.velar.plus/.well-known/ard.json): Machine-readable ARD 1.0 JSON manifest. - [AI Catalog Discovery](https://site-check.velar.plus/.well-known/ai-catalog.json): Structured JSON resource catalog for AI crawlers.