Pentest Defense Score — AISeen Docs

Checks if Access-Control-Allow-Origin is set to wildcard (*) or reflects arbitrary origins. A misconfigured CORS policy lets malicious sites make authenticated requests on behalf of your users.

Tests if the server returns HTTP 429 Too Many Requests or enforces any rate limit. Without rate limiting, attackers can brute-force login pages, APIs, and admin panels.

Checks Server, X-Powered-By, and X-AspNet-Version headers for version numbers. Disclosing exact versions helps attackers find and exploit known CVEs quickly.

Sends a probe with a SQL injection character (') and checks if the response contains database error messages. Even partial SQL errors confirm injection vulnerabilities and reveal DB structure.

Probes common high-risk URLs: /.git, /.env, /wp-admin, /phpmyadmin, /admin, /backup.zip, /backup.sql, /config.php, /.htaccess, /database.sql. Any accessible path can expose credentials or source code.

Checks for /.well-known/security.txt — the standard file where you disclose how to report security vulnerabilities. Its absence is a minor signal that security is not a priority.