Security headers and the OWASP WSTG checklist.
How hardened is your website?
HSTS, CSP, clickjacking, cookies, CORS and version leaks with an A+–F grade and the configuration for your server.
OWASP pentest checklist
64 OWASP WSTG tests with how to perform them, evidence notes and a report.
Ciberkit