When someone asks you to sanity-check a live website before a campaign or after a DNS cutover, you rarely have SSH keys or CMS admin access right away. Even when you do, firing an active vulnerability scanner against a production server without formal change approval is a bad idea: aggressive crawlers trip WAF rate limits, pollute analytics, and submit junk to contact endpoints.

A single passive HTTP request gives you a fast, non-intrusive baseline. From the public response headers and the first few kilobytes of HTML alone, you can verify transport locks, redirect latency, crawler directives, and social metadata in under a minute.

Four-layer table comparing signals, healthy baselines, and silent failures across security locks, server latency, crawl readiness, and search metadata

1. Check redirect hops and browser security headers with curl

Start by following redirects with -sIL so you see every intermediate 301 or 302 hop along with the final response headers:

curl -sIL --max-redirs 5 https://example.com | grep -iE "^(http/|location:|strict-transport-security:|content-security-policy:|x-frame-options:|x-content-type-options:|x-robots-tag:|x-powered-by:)"

Look for four specifics in that output (documented in detail in the OWASP HTTP Headers Cheat Sheet):

  1. Single-hop canonical redirect: Entering http://example.com should jump straight to the canonical https:// URL in one redirect. Chains like http://example.com -> https://example.com -> https://www.example.com -> https://www.example.com/ waste round trips on high-latency mobile networks.
  2. Strict-Transport-Security (HSTS): Confirms browsers pin HTTPS for repeat visits. Test subdomains carefully before adding includeSubDomains or preload.
  3. Framing and injection locks: Check for a Content-Security-Policy header (at minimum frame-ancestors 'self' to block clickjacking, paired with X-Frame-Options: SAMEORIGIN for legacy clients) and X-Content-Type-Options: nosniff.
  4. No leaked runtime versions: Strip X-Powered-By: PHP/x.y.z (expose_php = Off in php.ini or fastcgi_hide_header X-Powered-By; in Nginx) so automated scanners cannot filter targets by minor version banner.

In Nginx, remember the always parameter on add_header; without it, Nginx omits security headers on 404 and 500 responses, and remember that any child location block with its own add_header overrides parent-level headers unless repeated or moved to an include snippet:

add_header Strict-Transport-Security "max-age=31536000" always; add_header Content-Security-Policy "frame-ancestors 'self';" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always;

2. Measure DNS, TLS, and Time to First Byte (TTFB)

Visual metrics like Largest Contentful Paint depend heavily on how fast the server delivers the first byte of HTML. Google's web.dev TTFB documentation sets the "good" threshold at 0.8 seconds (800 ms) or less, and flags anything over 1.8 seconds as poor.

Print the exact connection phases with curl's -w format string:

curl -sL -o /dev/null -w "status=%{http_code} redirects=%{num_redirects} dns=%{time_namelookup}s tls=%{time_appconnect}s ttfb=%{time_starttransfer}s\n" https://example.com

If time_appconnect is fast (< 0.15s) while time_starttransfer exceeds 1.0s, the bottleneck sits behind TLS termination: usually uncached database queries on the homepage, cold serverless functions, or origin servers located far from your visitors without CDN edge caching.

3. Inspect the first 64 KB of HTML for indexing and mobile traps

Security checklists often ignore the HTML body, while SEO crawlers often ignore response headers. Reading the opening <head> markup catches deployment mistakes that break search visibility silently:

curl -sL --max-time 7 https://example.com | head -c 65536 | grep -iE "<title|name=[\"'](description|viewport|robots|generator)[\"']|rel=[\"']canonical[\"']|property=[\"']og:image[\"']|<h1"

Verify five items in that output:

  • No accidental noindex: Check both <meta name="robots"> and the HTTP X-Robots-Tag header. Leaving staging noindex rules active after launch drops the domain from Google Search and AI search tools; see Google Search Central's noindex documentation.
  • Mobile viewport present: Confirm <meta name="viewport" content="width=device-width, initial-scale=1"> exists so mobile browsers do not shrink a 980px desktop canvas.
  • Self-referencing rel="canonical": Prevents ad campaign query strings (?utm_source=..., ?gclid=...) from splitting indexing signals across duplicate URLs.
  • Complete title, H1, and og:image: Broken or missing og:image URLs render empty link cards whenever customers share the site on Slack, WhatsApp, or LinkedIn.
  • Clean <title> and <meta name="description">: Compromised CMS plugins frequently serve normal visuals to logged-in admins while injecting spam keywords into the public <title> for anonymous requests and search bots.

4. Safety rules if you automate passive checks

If you wrap these checks into a lightweight web endpoint or internal monitoring script, treat every user-supplied URL as untrusted input to prevent Server-Side Request Forgery (SSRF):

  • Allow only http: and https: schemes on standard ports (80 and 443), and reject URLs containing embedded username:password credentials.
  • Block raw IPv4/IPv6 literals as well as localhost, .local, .internal, and .arpa hostnames, and validate resolved DNS records if your runtime permits private-network routing.
  • Cap redirect hops (for example, max 4 redirects), enforce a strict fetch timeout (around 5 to 7 seconds), and stream at most the first 128 KB of HTML so a multi-gigabyte response cannot exhaust worker memory.

For a ready-made browser tool that runs these exact passive checks on Cloudflare Workers and prints a plain-language summary in English or Indonesian, you can test any public URL on Wanoh Digital Website Check.

Quick pre-launch verification routine

Keep those three curl commands in a shell alias or post-deploy script and run them right after every DNS switch, certificate renewal, or CMS upgrade. One passive request takes less than two seconds and catches the exact misconfigurations that otherwise sit unnoticed until search traffic or customer conversions drop.

Disclosure note: AI tools assisted with structuring and editing this guide; all commands, configurations, and technical references were verified by the author, Harry Agustiana.