# QuickAudit — web security checklist > Ten-point OWASP-style security checklist for the page you're on: headers, cookies, mixed content, exposed files, JS library CVEs. Canonical page: [https://chrome-stats.com/d/quickaudit-web-security](https://chrome-stats.com/d/quickaudit-web-security) ## Overview - **ID:** `quickaudit-web-security` - **Platform:** Firefox - **Type:** Firefox add-on - **Status:** Available - **Publisher:** BAB Studios - **Category:** web-development,privacy-security - **Daily users:** 1 - **Version:** 1.0.0 - **Last updated:** 2026-08-04 - **First published:** 2026-08-01 - **Size:** 64 KB - **Data as of:** 2026-09-06 - **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/quickaudit-web-security/) - **Website:** [https://github.com/BAB78/quickaudit](https://github.com/BAB78/quickaudit) - **Privacy policy:** [https://addons.mozilla.org/firefox/addon/quickaudit-web-security/privacy/](https://addons.mozilla.org/firefox/addon/quickaudit-web-security/privacy/) ## Description A pre-pentest sanity check that takes five seconds instead of fifteen minutes. Before you pay for a penetration test — or before you ship — there's a set of boring, mechanical misconfigurations that show up on a depressing share of production sites. No HSTS. No CSP. Session cookies without HttpOnly. A .git directory served to the public internet. jQuery 1.8 with four known XSS advisories. Finding these today means running curl -I, squinting at headers you half-remember, checking DevTools for mixed content, and pasting library versions into a CVE search. That's fifteen minutes per site, so people skip it, so it ships broken. QuickAudit is that checklist, as one button. The ten checks: 1. Transport security — HTTPS, plus HSTS with max-age 2. Content-Security-Policy — present, enforcing, and not defeated by 'unsafe-inline' / 'unsafe-eval' / wildcards 3. Clickjacking protection — CSP frame-ancestors or X-Frame-Options 4. MIME-sniffing — X-Content-Type-Options: nosniff 5. Referrer & Permissions policy — flags policies that leak full URLs to third parties 6. Cookie security flags — Secure, HttpOnly on session cookies, explicit SameSite 7. Mixed content — http:// subresources on an HTTPS page 8. JavaScript libraries with known CVEs — versions read from live page globals, looked up against OSV.dev 9. Exposed sensitive files — /.env, /.git/HEAD, etc. (Off by default) 10. Server version disclosure — banners that hand attackers your exact build number Privacy: QuickAudit sends exactly one kind of data off your machine: detected library name@version strings, to api.osv.dev, to look up known CVEs. No URLs. No page content. No cookie values — the code reads cookie flags and deliberately discards values. No analytics. No account. No telemetry. Source: https://github.com/BAB78/quickaudit ## Rankings - #120,109 — Overall - #121 — jquery - #156 — security ## Permissions and access ### Permissions - `activeTab` - `storage` - `cookies` - `scripting` - `downloads` ## Safety - **Risk impact:** Low risk impact - **Risk likelihood:** High risk likelihood ### Analysis details - Allows management of download operations but generally doesn't severely affect security unless misused. - This extension has low user count. Unpopular extensions may not be stable or safe. > Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing). ## Similar extensions and apps - [Security Header Grader](https://chrome-stats.com/d/security-header-grader) — 2 users - [Web Security Audit](https://chrome-stats.com/d/web-security-audit) — 56 users, 5.00 / 5 - [I Hate Security Headers!](https://chrome-stats.com/d/i-hate-security-headers) — 2 users - [One Click Site Inspector](https://chrome-stats.com/d/one-click-site-inspector) — 8 users - [Tyre-Kicker-Security](https://chrome-stats.com/d/tyre-kicker-security) — 1 users - [A1 Accessibility Quick Audit](https://chrome-stats.com/d/a1-accessibility-quick-audit) - [OWASP Secure Headers](https://chrome-stats.com/d/owasp-secure-headers) — 9 users - [Vulnerability Scanner](https://chrome-stats.com/d/vulnerability-scanner) — 9 users - [OWASP Secure Headers Checker](https://chrome-stats.com/d/owasp-secure-headers-checker) — 8 users - [SecureGuard - Web Security Scan](https://chrome-stats.com/d/secureguard-web-security-scan) — 1 users - [HTTP Header Security Auditor](https://chrome-stats.com/d/http-header-security-auditor) — 2 users - [Qualys' security Check](https://chrome-stats.com/d/qualys-security-check) — 1 users --- Source: [Chrome-Stats](https://chrome-stats.com/d/quickaudit-web-security)