How is this different from a normal OWASP checklist?

The checklist mode is the familiar interactive OWASP Top 10 (2021) self-assessment with a weighted score. What sets this tool apart is the two scanner modes: paste real source code or HTTP response headers and it statically detects insecure patterns — XSS sinks, eval/new Function, hardcoded secrets, SQL string concatenation, weak randomness, disabled TLS verification, permissive CORS, and missing or leaky security headers — mapping each to an OWASP category with a line number and a fix.

What does the HTTP header scan check?

Paste a raw block of response headers and it flags missing security headers — Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy (all Security Misconfiguration, A05). It also warns about information disclosure via versioned Server and X-Powered-By headers, an Access-Control-Allow-Origin of "*" (worse with credentials), and Set-Cookie directives missing the Secure, HttpOnly, or SameSite flags.

Is my code or are my headers sent anywhere?

No. The scanner is pure client-side JavaScript — all pattern matching runs in your browser and nothing is uploaded to a server. That makes it safe to paste proprietary code or production response headers. The shareable URL only encodes what you choose to share.

Can I rely on this instead of a full security audit?

No. Static pattern scanning is fast and great for catching common, obvious mistakes as a first pass, but by design it can miss context-dependent vulnerabilities (logic flaws, broken access control, business-logic bugs) and can occasionally flag safe code. Use it alongside dependency scanning, code review, SAST/DAST tooling, and a proper security audit — not as a replacement.

How is the security score calculated?

In scan modes the score starts at 100 and subtracts a weighted penalty for each finding — critical findings cost the most, then high, medium, and low — clamped to a 0–100 range and mapped to an A–F grade. In checklist mode the score is the proportion of controls you have ticked, weighted by each item's importance (critical items count more than high or medium). Both are heuristics meant to show relative risk, not a certification.

OWASP Security Checker

More than a checklist — paste source code or a block of HTTP response headers and the scanner flags the insecure patterns people actually ship: XSS sinks, eval, hardcoded secrets, SQL string-building, weak randomness, disabled TLS verification, permissive CORS, and missing security headers. Each finding maps to an OWASP Top 10 (2021) category with the exact line, a fix, and a reference. Or run the interactive OWASP Top 10 readiness checklist for a weighted score you can export.

About this ToolHow it works, benefits & use cases

Most "OWASP checker" tools are just a static checklist you tick by hand. This one does that too — an interactive OWASP Top 10 (2021) readiness checklist with a weighted score and a per-category breakdown — but its real differentiator is a static pattern scanner. Paste a file, a function, or a snippet and it flags the insecure code people actually ship: writing untrusted data to innerHTML / outerHTML / dangerouslySetInnerHTML, eval and new Function, hardcoded API keys and secrets (including AWS AKIA keys and Stripe sk_live keys), SQL queries built by string concatenation or template-literal interpolation, Math.random() used for tokens, disabled TLS certificate verification (rejectUnauthorized: false, verify=False, NODE_TLS_REJECT_UNAUTHORIZED=0), and wildcard CORS. Switch to header mode and paste a block of HTTP response headers to catch missing security headers (Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), version-leaking Server / X-Powered-By headers, and Set-Cookie directives missing Secure, HttpOnly, or SameSite. Every finding maps to a specific OWASP Top 10 (2021) category with the exact line, an excerpt, a concrete fix, and a reference link — and produces a weighted security score. Everything runs entirely in your browser; nothing is uploaded.

How to Use

1Choose a mode: Scan code, Scan headers, or the interactive Checklist.
2In a scan mode, paste your source code or raw HTTP response headers (or click "Load sample" to see it work).
3Read the findings list — each is severity-sorted with its OWASP category, line number, code excerpt, and a remediation tip.
4Check the security score and severity breakdown to gauge overall risk, then copy or share the report.
5In Checklist mode, tick the controls you have in place to get a weighted readiness score, per-category breakdown, and a Markdown export.

Key Benefits

Two tools in one: an interactive OWASP Top 10 checklist AND a static code/header scanner
Detects real-world issues — XSS sinks, eval, hardcoded secrets, SQL string-building, weak randomness, disabled TLS, wildcard CORS
Header mode flags missing CSP/HSTS/X-Frame-Options and insecure Set-Cookie flags
Every finding maps to a specific OWASP Top 10 (2021) category with a line number and a fix
Weighted 0–100 security score with a letter grade and severity counts
Exports a copyable Markdown report and a shareable URL
100% client-side — your code and headers never leave the browser

Common Use Cases

A quick pre-commit or pre-PR self-check of a file or function for obvious security mistakes
Auditing a response from your API or site for missing security headers and leaky cookies
Teaching juniors which patterns map to which OWASP Top 10 category and why they matter
Tracking secure-coding readiness across a project with the weighted checklist
Spotting hardcoded API keys or secrets before they get committed

Security score100/100(A)

Critical

High

Medium

Low

Paste code or headers to begin scanning — results appear here instantly.

Scan report

Copyable summary of every finding

# OWASP Security Scan (source code)

Security score: 100/100 (grade A)
Findings: 0 — 0 critical, 0 high, 0 medium, 0 low

No insecure patterns detected by static scanning.
(Static scanning catches common patterns — it is not a substitute for a full audit.)

Source code

Paste a file, function, or snippet

Scanning is static & runs entirely in your browser — paste freely.

The OWASP Top 10 (2021)

The OWASP Top 10 is the industry-standard awareness list of the most critical web application security risks, from A01 Broken Access Control through A10 Server-Side Request Forgery. The checklist mode turns it into a weighted readiness score you can track and export; the scan modes go further and read your actual code or response headers, mapping every issue back to the category it belongs to.

What the scanner catches

Code: innerHTML/dangerouslySetInnerHTML, eval/new Function, hardcoded secrets & API keys, SQL built by concatenation, Math.random() tokens, disabled TLS verification, and wildcard CORS.
Headers: missing CSP, HSTS, X-Frame-Options, X-Content-Type-Options & Referrer-Policy, version-leaking Server/X-Powered-By, and cookies missing Secure/HttpOnly/SameSite.

Static scanning is fast and catches the common, high-signal patterns — but it can miss context-dependent flaws and produce false positives. Treat it as a first pass, not a replacement for a full security audit, code review, or dynamic testing.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on

OWASP Security Checker

How to Use

Key Benefits

Common Use Cases

Source code

The OWASP Top 10 (2021)

What the scanner catches

Was this tool helpful?

Share Your Experience

Related tools

Frequently Asked Questions - OWASP Security Checker