site-server-auditlisted

# Site / Server Audit A read-only, non-intrusive checklist for assessing the security posture of a website you have authorization to audit. Every check is passive — it does not exploit, brute-force, or modify the target. ## When to invoke - Onboarding a new client site, before deploy, after an infrastructure change - Periodic re-audit (quarterly is a reasonable cadence for production) - After any security advisory affecting the stack (Apache/nginx/PHP/WordPress/Node) - When deciding whether to put a site behind Cloudflare or migrate hosting ## Required inputs - A target hostname you are authorized to audit - Optionally: doc-root path if you have shell access (for file-side checks) If you do not have written authorization for the target, **stop**. This skill is for owners and authorized auditors. ## Audit — DNS ```bash # Authoritative records and chain of trust dig +short A example.com dig +short AAAA example.com dig +short MX example.com dig +short TXT example.com dig +short CAA example.com # missing CAA means any CA can issue certs for you dig +dnssec +short example.com | grep -i 'RRSIG\|ad' # DNSSEC presence # Mail-auth records (only meaningful if the domain sends mail) dig +short TXT example.com | grep -i 'v=spf1' dig +short TXT _dmarc.example.com dig +short TXT default._domainkey.example.com # adjust selector ``` Flags: - Missing CAA → consider adding one pinning your CA(s) - Missing DMARC or `p=none` on a domain that sends mail → spoofing risk - DNSSEC ab