Website scans
Website scans
The website scanner reads your public site and checks for a privacy notice, cookie consent before tracking, safe forms and security headers — then tracks what it finds as issues, next to your code findings.
On this page
All checks at a glance
21 checks in four groups. A check runs when the website project tracks at least one of its frameworks. This table is generated from the scanner's rule list.
| Check | Severity | Frameworks |
|---|---|---|
| No privacy notice linkeddpdp.website-privacy-notice | high | DPDP, GDPR, CCPA, LGPD |
| Privacy notice has no grievance contactdpdp.website-grievance-officer | medium | DPDP |
| Privacy notice has no contact detailsdpdp.website-privacy-contact | medium | DPDP, GDPR, CCPA, LGPD |
| Privacy notice doesn't explain data rightsdpdp.website-data-rights | medium | DPDP, GDPR, CCPA, LGPD |
| No terms of service linkedgdpr.website-terms | low | GDPR, DPDP |
| No cookie notice for cookies or trackers in usegdpr.website-cookie-policy | medium | GDPR, DPDP, LGPD, CCPA |
| Analytics or advertising cookies set before consentgdpr.website-cookies-before-consent | high | GDPR, DPDP, LGPD |
| Session cookie missing security flagssoc-2.website-cookie-flags | medium | SOC 2, ISO 27001, PCI DSS, GDPR, DPDP |
| Trackers load without a consent bannergdpr.website-trackers-without-consent | medium | GDPR, DPDP, LGPD |
| Global Privacy Control not honouredccpa.website-gpc | low | CCPA |
| Form collects personal data without a privacy noticedpdp.website-form-without-notice | medium | DPDP, GDPR, LGPD, CCPA |
| Form submits over insecure HTTPsoc-2.website-form-insecure-action | high | SOC 2, PCI DSS, ISO 27001, HIPAA, GDPR, DPDP |
| Site isn't served only over HTTPSsoc-2.website-https | high | SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, DPDP |
| HSTS header missing or too shortsoc-2.website-hsts | medium | SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, DPDP |
| No Content-Security-Policysoc-2.website-csp | medium | SOC 2, ISO 27001, PCI DSS, GDPR, DPDP |
| Page can be embedded by other sitessoc-2.website-clickjacking | medium | SOC 2, ISO 27001, PCI DSS, GDPR, DPDP |
| X-Content-Type-Options: nosniff not setsoc-2.website-nosniff | low | SOC 2, ISO 27001, PCI DSS |
| No Referrer-Policy setiso-27001.website-referrer-policy | low | ISO 27001, SOC 2, GDPR, DPDP |
| Insecure http:// resources on an HTTPS pagesoc-2.website-mixed-content | high | SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, DPDP |
| Server software version exposedsoc-2.website-server-banner | low | SOC 2, ISO 27001, PCI DSS |
| No security.txtsoc-2.website-security-txt | low | SOC 2, ISO 27001 |
No privacy notice linkeddpdp.website-privacy-notice
- Severity
- high
- Frameworks
- DPDP, GDPR, CCPA, LGPD
Privacy notice has no grievance contactdpdp.website-grievance-officer
- Severity
- medium
- Frameworks
- DPDP
Privacy notice has no contact detailsdpdp.website-privacy-contact
- Severity
- medium
- Frameworks
- DPDP, GDPR, CCPA, LGPD
Privacy notice doesn't explain data rightsdpdp.website-data-rights
- Severity
- medium
- Frameworks
- DPDP, GDPR, CCPA, LGPD
No terms of service linkedgdpr.website-terms
- Severity
- low
- Frameworks
- GDPR, DPDP
No cookie notice for cookies or trackers in usegdpr.website-cookie-policy
- Severity
- medium
- Frameworks
- GDPR, DPDP, LGPD, CCPA
Analytics or advertising cookies set before consentgdpr.website-cookies-before-consent
- Severity
- high
- Frameworks
- GDPR, DPDP, LGPD
Session cookie missing security flagssoc-2.website-cookie-flags
- Severity
- medium
- Frameworks
- SOC 2, ISO 27001, PCI DSS, GDPR, DPDP
Trackers load without a consent bannergdpr.website-trackers-without-consent
- Severity
- medium
- Frameworks
- GDPR, DPDP, LGPD
Global Privacy Control not honouredccpa.website-gpc
- Severity
- low
- Frameworks
- CCPA
Form collects personal data without a privacy noticedpdp.website-form-without-notice
- Severity
- medium
- Frameworks
- DPDP, GDPR, LGPD, CCPA
Form submits over insecure HTTPsoc-2.website-form-insecure-action
- Severity
- high
- Frameworks
- SOC 2, PCI DSS, ISO 27001, HIPAA, GDPR, DPDP
Site isn't served only over HTTPSsoc-2.website-https
- Severity
- high
- Frameworks
- SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, DPDP
HSTS header missing or too shortsoc-2.website-hsts
- Severity
- medium
- Frameworks
- SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, DPDP
No Content-Security-Policysoc-2.website-csp
- Severity
- medium
- Frameworks
- SOC 2, ISO 27001, PCI DSS, GDPR, DPDP
Page can be embedded by other sitessoc-2.website-clickjacking
- Severity
- medium
- Frameworks
- SOC 2, ISO 27001, PCI DSS, GDPR, DPDP
X-Content-Type-Options: nosniff not setsoc-2.website-nosniff
- Severity
- low
- Frameworks
- SOC 2, ISO 27001, PCI DSS
No Referrer-Policy setiso-27001.website-referrer-policy
- Severity
- low
- Frameworks
- ISO 27001, SOC 2, GDPR, DPDP
Insecure http:// resources on an HTTPS pagesoc-2.website-mixed-content
- Severity
- high
- Frameworks
- SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, DPDP
Server software version exposedsoc-2.website-server-banner
- Severity
- low
- Frameworks
- SOC 2, ISO 27001, PCI DSS
No security.txtsoc-2.website-security-txt
- Severity
- low
- Frameworks
- SOC 2, ISO 27001
Add a website
In the dashboard open Websites, enter your site's address, choose the frameworks to check and confirm that you own the website or are responsible for it. RuleFix adds it as a project and runs the first scan straight away; findings appear on the project and in Issues alongside code findings.
Only scan sites you're authorised to scan
The confirmation is required, and scanning sites without permission breaks our Acceptable Use Policy. RuleFix only scans public addresses: names that resolve to private or internal networks are refused before anything is fetched.
- Run it again any time with Scan again (once a minute per site; up to 5 website scans per workspace per minute).
- A workspace can track up to 50 websites.
- A complete scan closes issues that are no longer found; a partial scan (some pages couldn't be read) leaves them open — the same rule as repository scans.
How the crawl works
RuleFix reads your site the way a search engine does, politely and within fixed bounds:
- Fetches
robots.txtfirst and follows it. If it disallows RuleFix's crawler (or all crawlers) for the homepage, nothing is scanned. - Reads the homepage, then up to 11 more same-site pages: privacy, terms, cookie, grievance, contact, refund and about pages first, then a few top-navigation pages.
- Checks whether plain
http://redirects to HTTPS, and looks for/.well-known/security.txt(and/.well-known/gpc.jsonwhen CCPA is selected).
| Limit | Value |
|---|---|
| Pages per scan | 12 |
| Requests in flight | 3 |
| Per request | 10 s, up to 5 redirects |
| Whole scan | 45 s |
| User agent | RuleFixBot/1.0 (+https://rulefix.in/bot) |
Pages per scan
- Value
- 12
Requests in flight
- Value
- 3
Per request
- Value
- 10 s, up to 5 redirects
Whole scan
- Value
- 45 s
User agent
- Value
RuleFixBot/1.0 (+https://rulefix.in/bot)
What it doesn't do
- It runs no JavaScript. Banners, links or content rendered only in the browser can be missed — a common cause of a “no consent banner” finding on a site that does have one.
- It never signs in, submits forms or accepts cookies, so pages behind a login aren't checked.
- Results are automated checks, not legal advice.
If a scan fails
- Blocked by robots.txt — allow the
RuleFixBotuser agent inrobots.txt. - HTTP 401, 403 or 429 — a firewall or bot protection refused the request; allow the RuleFixBot user agent and try again.
- Certificate error — RuleFix stops if the HTTPS certificate can't be verified.
- Not HTML — the homepage must return an HTML page.
Legal pages
Whether visitors can find a privacy notice and terms, and whether the notice covers contacts, grievances and data rights.
No privacy notice linked
dpdp.website-privacy-notice
DPDPGDPRCCPALGPD
- What it checks
- None of the pages RuleFix read link to a privacy policy or privacy notice.
- Why it matters
- Data protection laws expect you to tell people what personal data you collect, why, and how they can exercise their rights, and to make that notice easy to find from every page.
- How to fix
- Publish a privacy notice and link it from the footer of every page (e.g. /privacy), and from any form that collects personal data.
Privacy notice has no grievance contact
dpdp.website-grievance-officer
DPDP
- What it checks
- The privacy notice doesn't mention a grievance officer, Data Protection Officer or a grievance redressal process.
- Why it matters
- Under the DPDP Act and Rules, Data Principals must be able to raise grievances with the Data Fiduciary, and the notice is expected to give the contact details of a person who can answer their questions about processing.
- How to fix
- Add a section to the privacy notice naming the grievance officer (or DPO), with an email address and how to raise a grievance, and the response timeline you commit to.
Privacy notice has no contact details
dpdp.website-privacy-contact
DPDPGDPRCCPALGPD
- What it checks
- The privacy notice contains no email address, contact link or phone number.
- Why it matters
- People need a way to ask questions about their data and to make requests; data protection laws expect the notice to say how to reach you.
- How to fix
- Add a privacy contact (e.g. privacy@yourdomain, or a link to a contact form) to the privacy notice.
Privacy notice doesn't explain data rights
dpdp.website-data-rights
DPDPGDPRCCPALGPD
- What it checks
- The privacy notice doesn't mention how people can access, correct or erase their data, or withdraw consent.
- Why it matters
- DPDP gives Data Principals rights to access, correction, erasure and withdrawal of consent; GDPR, CCPA and LGPD give similar rights. The notice is where people learn how to use them.
- How to fix
- Add a 'Your rights' section explaining how to request access, correction and deletion of data and how to withdraw consent, with the contact to use.
No terms of service linked
gdpr.website-terms
GDPRDPDP
- What it checks
- None of the pages RuleFix read link to terms of service, terms of use or terms and conditions.
- Why it matters
- Terms set out the rules for using your service and usually reference how personal data is handled; visitors and auditors expect to find them next to the privacy notice.
- How to fix
- Publish terms of service and link them from the site footer next to the privacy notice.
No cookie notice for cookies or trackers in use
gdpr.website-cookie-policy
GDPRDPDPLGPDCCPA
- What it checks
- The site uses tracking cookies or scripts, but no cookie policy is linked and the privacy notice doesn't cover cookies.
- Why it matters
- Visitors must be told which cookies and trackers you use and why before they can give informed consent.
- How to fix
- Publish a cookie policy (or a cookies section in the privacy notice) listing each cookie/tracker, its purpose, provider and duration, and link it from the footer and the consent banner.
Cookies & trackers
Analytics and advertising cookies or scripts that run before a choice is made, and session cookie flags.
Analytics or advertising cookies set before consent
gdpr.website-cookies-before-consent
GDPRDPDPLGPD
- What it checks
- The server sets cookies that look like analytics or advertising cookies (e.g. _ga, _fbp, _gcl_au, _hj*) on the very first response, before the visitor could make any choice.
- Why it matters
- Non-essential cookies generally require the visitor's prior consent under GDPR and the ePrivacy rules, and DPDP expects consent to be obtained before personal data is processed for such purposes.
- How to fix
- Stop setting these cookies server-side on first load. Set them only after the visitor accepts the relevant category in your consent banner, and remove them when consent is withdrawn.
Session cookie missing security flags
soc-2.website-cookie-flags
SOC 2ISO 27001PCI DSSGDPRDPDP
- What it checks
- A cookie that looks like a session or authentication cookie is missing Secure and/or HttpOnly.
- Why it matters
- Without Secure the cookie can travel over plain HTTP; without HttpOnly any injected script can read it and hijack the session.
- How to fix
- Set session cookies with
Secure; HttpOnly; SameSite=Lax(orStrict), ideally with the__Host-prefix and no Domain attribute.
Trackers load without a consent banner
gdpr.website-trackers-without-consent
GDPRDPDPLGPD
- What it checks
- The page loads third-party analytics or advertising scripts (e.g. Google Analytics/Tag Manager, Meta Pixel, Hotjar, Clarity) and no recognisable consent manager or cookie banner with accept/reject choices was found in the HTML.
- Why it matters
- These scripts typically set cookies and send visitor data to third parties. That generally needs a clear, prior and freely given choice under GDPR, and DPDP requires consent through a clear affirmative action.
- How to fix
- Add a consent manager (or your own banner) that offers equally prominent Accept and Reject options and loads trackers only after consent. With Google tags, set Consent Mode defaults to denied before any tag loads.
Global Privacy Control not honoured
ccpa.website-gpc
CCPA
- What it checks
- The site uses tracking scripts but shows no sign of supporting the Global Privacy Control (GPC) browser signal.
- Why it matters
- California regulations treat GPC as a valid request to opt out of the sale or sharing of personal information.
- How to fix
- Read
navigator.globalPrivacyControl(and theSec-GPC: 1request header) and treat it as an opt-out of sale/sharing. Mention GPC in your privacy notice and publish /.well-known/gpc.json.
Forms
Forms that collect personal data without a notice, or submit it over plain HTTP.
Form collects personal data without a privacy notice
dpdp.website-form-without-notice
DPDPGDPRLGPDCCPA
- What it checks
- A form asks for an email address, phone number or name, and there is no privacy link, notice text or consent checkbox in or next to it.
- Why it matters
- DPDP and GDPR expect people to be told what their data will be used for at the point it is collected, and consent (where relied on) to be specific and informed.
- How to fix
- Add a short notice next to the submit button, e.g. 'We use your email to send the newsletter. See our Privacy Policy.', linking the privacy notice. Add an unticked checkbox where you rely on consent (e.g. marketing).
Form submits over insecure HTTP
soc-2.website-form-insecure-action
SOC 2PCI DSSISO 27001HIPAAGDPRDPDP
- What it checks
- A form's action posts to an http:// URL, so whatever visitors type is sent unencrypted.
- Why it matters
- Anyone on the network path can read or alter the submitted data, including personal data and credentials.
- How to fix
- Change the form action to https:// (or a relative URL on your HTTPS site) and make sure the endpoint redirects HTTP to HTTPS.
Security headers
Transport security and the response headers that protect visitors' data.
Site isn't served only over HTTPS
soc-2.website-https
SOC 2ISO 27001PCI DSSHIPAAGDPRDPDP
- What it checks
- The plain http:// address serves the page instead of redirecting visitors to https://.
- Why it matters
- Pages served over HTTP can be read and changed by anyone on the network path, including any personal data visitors type in. Encryption in transit is a baseline control in SOC 2, ISO 27001 and data protection laws.
- How to fix
- Redirect every http:// request to the same path on https:// with a 301 or 308 at your web server, CDN or hosting platform, then add a Strict-Transport-Security header.
HSTS header missing or too short
soc-2.website-hsts
SOC 2ISO 27001PCI DSSHIPAAGDPRDPDP
- What it checks
- The HTTPS response has no Strict-Transport-Security header, or its max-age is under 180 days.
- Why it matters
- Without HSTS, a visitor's first request can be downgraded to HTTP and intercepted (SSL stripping), even when the site redirects to HTTPS.
- How to fix
- Send
Strict-Transport-Security: max-age=31536000; includeSubDomainson every HTTPS response. Addpreloadonly once every subdomain supports HTTPS.
No Content-Security-Policy
soc-2.website-csp
SOC 2ISO 27001PCI DSSGDPRDPDP
- What it checks
- The page sets no Content-Security-Policy header or meta tag (a Report-Only policy alone doesn't enforce anything).
- Why it matters
- A CSP limits which scripts can run, which reduces the impact of cross-site scripting and of compromised third-party scripts reading personal data from the page.
- How to fix
- Start with a restrictive policy such as
default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'and add the script, style and connect sources your site needs. Roll it out with Content-Security-Policy-Report-Only first, then enforce it.
Page can be embedded by other sites
soc-2.website-clickjacking
SOC 2ISO 27001PCI DSSGDPRDPDP
- What it checks
- Neither X-Frame-Options nor a CSP frame-ancestors directive is set, so any site can load this page in a frame.
- Why it matters
- Framing lets an attacker overlay your page and trick visitors into clicking buttons or submitting forms (clickjacking).
- How to fix
- Add
Content-Security-Policy: frame-ancestors 'self'(or'none'). For older browsers also sendX-Frame-Options: SAMEORIGINorDENY.
X-Content-Type-Options: nosniff not set
soc-2.website-nosniff
SOC 2ISO 27001PCI DSS
- What it checks
- Responses don't send
X-Content-Type-Options: nosniff. - Why it matters
- Without it, browsers may guess (sniff) content types and run uploaded or user-controlled files as scripts or styles.
- How to fix
- Send
X-Content-Type-Options: nosniffon all responses from your web server or CDN.
No Referrer-Policy set
iso-27001.website-referrer-policy
ISO 27001SOC 2GDPRDPDP
- What it checks
- No Referrer-Policy header or meta tag is set, or the policy sends full URLs to other sites.
- Why it matters
- Full page URLs can contain identifiers, emails or tokens. A policy controls what is shared with third parties when visitors follow links or load embedded resources.
- How to fix
- Send
Referrer-Policy: strict-origin-when-cross-origin(or stricter, such asno-referrer) on every response.
Insecure http:// resources on an HTTPS page
soc-2.website-mixed-content
SOC 2ISO 27001PCI DSSHIPAAGDPRDPDP
- What it checks
- An HTTPS page loads scripts, styles, frames or media over plain http://.
- Why it matters
- Insecure subresources can be read or replaced in transit. Browsers block active mixed content, which can also break the page; an injected script can read anything on it.
- How to fix
- Load every resource over https:// (or a relative URL). If the third party doesn't support HTTPS, self-host the file or replace the provider.
Server software version exposed
soc-2.website-server-banner
SOC 2ISO 27001PCI DSS
- What it checks
- Response headers such as Server or X-Powered-By reveal the software (and often the exact version) running the site.
- Why it matters
- Version details make it easy to match your site against known vulnerabilities. Hiding them doesn't fix anything, but removes free reconnaissance.
- How to fix
- Remove X-Powered-By (e.g.
app.disable('x-powered-by')in Express,poweredByHeader: falsein Next.js,expose_php = Off) and hide version numbers in Server (server_tokens offin nginx,ServerTokens Prodin Apache).
No security.txt
soc-2.website-security-txt
SOC 2ISO 27001
- What it checks
- There is no /.well-known/security.txt telling researchers how to report vulnerabilities.
- Why it matters
- A published security contact (RFC 9116) helps people report problems to you privately instead of disclosing them publicly; it supports incident and vulnerability management controls.
- How to fix
- Serve /.well-known/security.txt as text/plain with at least
Contact: mailto:security@yourdomainand anExpires:date within the next year.