How I built SiteSafeCheck

I'm Nick Castro. I built SiteSafeCheck, a free website security check for small businesses, with AI tools, and AI also runs inside the product. This page covers the problem, how it works, and the tradeoffs I made.

• 25checks in 5 categories
• 1Gemini call per fresh scan
• 67automated tests
• 100Lighthouse score in all 4 categories

The problem

Most security scanners talk in jargon: "Missing HSTS header", "DMARC p=none", "TLS 1.1 accepted". A bakery owner can't tell which of those matter or what to do about them, so the report gets ignored and the gaps stay open.

Who it's for

Small-business owners, and whoever manages their website. They get a grade, the evidence for each issue, what it means in plain English, the realistic worst case, and what kind of change fixes it. For me, it's also an honest way to find people who need the fixes I offer.

How it works

1. Passive checks in plain code. The scanner loads the public home page, reads headers and the certificate, looks up public DNS records (SPF, DMARC, 18 common DKIM selectors), and requests 10 well-known paths like /.env. No AI decides what's wrong.
2. A transparent score. Fixed rules turn the findings into a 0–100 score and an A–F grade, and the report shows the math.
3. One batched Gemini call. Every finding that needs attention goes to Gemini in a single JSON request, which writes a plain-English "what this means" and a one-sentence "worst case" for each.
4. Honesty filters and fallbacks. Each AI line is checked before it's shown. Anything that calls a site "secure", cites statistics, uses certainty words, pitches a service, or leaks a copy-paste config snippet is dropped and replaced with copy I wrote by hand. Every check has a hand-written version, so the report works even with AI off.

How I used AI and other tools

• AI inside the product: Google Gemini writes the explanations and worst-case lines, one request per fresh scan, under a daily cap. The AI can rewrite text for findings the code measured, but it can't add, remove, or upgrade them.
• AI while building: I used AI coding tools to write the checks, tests, and copy faster. I reviewed the changes, ran the test suite, and checked the live site after every deploy.
• Vercel: static pages plus one serverless function (/api/scan). Every push to main deploys automatically. Strict security headers are set in vercel.json, and the site scores an A (100/100) on its own check.
• GitHub: the code is public on GitHub, and GitHub Actions runs the tests on every push.
• SSRF protection: a scanner that fetches any URL is a classic way to reach internal systems. Every domain is resolved and validated, the connection is pinned to the validated IP, every redirect is re-checked, only ports 80 and 443 are allowed, private and cloud-metadata addresses are blocked, and every request has a timeout and size cap.
• Rate limits and caching: 10 fresh scans per hour and 30 per day for each visitor (by hashed IP), daily caps on total scans and AI calls, and a 10-minute cache per domain so repeat checks are instant and free.
• Automated tests: 67 tests cover the checks, scoring, the SSRF guard, the API, and the AI filters, using a mocked Gemini so they run offline.
• Lighthouse: the home page scores 100 for Performance, Accessibility, Best Practices, and SEO on mobile and desktop. To keep it there, analytics loads after the first interaction instead of blocking the first paint.

Key decisions and tradeoffs

Passive-only scanning

Sending attack traffic to someone's site can be illegal and can break things, so the scanner only does what a normal visitor or search engine does. The tradeoff: it can't find bugs inside code or plugins, and every report says so.

Holding the AI to hand-written baselines

In early live testing, the AI overstated a low-risk issue: it suggested a script could quietly use visitors' webcams, but browsers ask permission first. Now each AI worst case gets my hand-written version as a baseline, and the AI isn't allowed to go beyond it. I gave up some variety in exchange for accuracy.

Free diagnosis, paid fix

The free report explains each problem and names the kind of change that fixes it, but leaves out copy-paste configuration. The fix itself is my paid service. Work I don't do (penetration tests, code audits, malware or breach cleanup) is referred out, never sold.

A confirmation line instead of a checkbox

A required "I own this site" checkbox was stopping first-time visitors at the button. I replaced it with a line under the button ("By scanning, you confirm you own or manage this site"). The API still refuses requests without that confirmation, and it logs every one.

Results so far

Only numbers I can verify:

• 25 checks in 5 categories, counted from the check catalog in the code.
• 67 automated tests, all passing, from the test run for this version.
• Lighthouse 100/100/100/100 on the home page, mobile and desktop, measured October 14, 2026.
• Scan speed: in five fresh scans I timed on October 14, 2026, the checks themselves took 0.3–1.3 seconds, and the full report, including the AI write-up, took 5–28 seconds.
• Grade A (100/100) for sitesafecheck.com on its own check.

Scan my site freeView the code on GitHubMore of my work