{"id":16417335,"url":"https://github.com/sesh/ready","last_synced_at":"2025-06-25T10:37:44.751Z","repository":{"id":62907776,"uuid":"351227154","full_name":"sesh/ready","owner":"sesh","description":"Are you production ready?","archived":false,"fork":false,"pushed_at":"2024-12-13T00:35:35.000Z","size":162,"stargazers_count":29,"open_issues_count":6,"forks_count":4,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-06-20T02:43:20.057Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"isc","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sesh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.txt","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-03-24T21:25:26.000Z","updated_at":"2025-05-05T21:39:58.000Z","dependencies_parsed_at":"2024-03-08T20:40:41.283Z","dependency_job_id":"dd15e7ef-6a2c-42cb-88ab-bf2f0df2c49e","html_url":"https://github.com/sesh/ready","commit_stats":null,"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"purl":"pkg:github/sesh/ready","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesh%2Fready","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesh%2Fready/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesh%2Fready/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesh%2Fready/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sesh","download_url":"https://codeload.github.com/sesh/ready/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesh%2Fready/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261584302,"owners_count":23180683,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-11T07:11:26.881Z","updated_at":"2025-06-25T10:37:44.742Z","avatar_url":"https://github.com/sesh.png","language":"Python","readme":"🚀 `ready` is a tool for developers to check how production ready their website.\n\n\n## Usage\n\nThe simplest way to quickly check your site is with `uvx`:\n\n```\nuvx --from ready-check ready \u003cdomain\u003e\n```\n\nAlternatively, install the tool from PyPI with:\n\n```\npip install ready-check\n```\n\nRunning the checks for a domain is as simple as:\n\n```\nready \u003cdomain\u003e\n```\n\nFor more options, check the output of `--help`.\n\n\n### Usage during development\n\nIf you have cloned the repository and would like to run the checks with your local version, simply run:\n\n```\npython3 -m ready.ready \u003cdomain\u003e [--request-filter=\u003cx\u003e] [--check-filter=\u003cx\u003e]\n```\n\n### Optional Dependencies\n\nThere are no required dependencies, but two optional dependencies that enable some additional behaviour:\n\n- Installing the `tld` package adds support for using the fully-qualified domain name for some DNS-related checks. This is handy if you want to check a subdomain.\n- Installing `beautifulsoup4` adds support for extracting some headers from the HTML document as well as the headers. This technique can be used for sites that use static hosting like Github Pages.\n\nNote: if you install from PyPI these dependencies are installed.\n\n\n## Check list\n\n- Cookies should set the SameSite flag\n- Cookies should set the Secure flag\n- Cookies should set the HttpOnly flag\n- Swagger URLs should not return 200 (requires --fuzz)\n- HSTS Header should be included in response\n- HSTS Header should have a long max-age\n- HSTS Header should have includeSubdomains\n- HSTS Header should have preload\n- An AAAA DNS record exists (IPv6 Support)\n- HTTP -\u003e HTTPS redirection occurs\n- Permissions-Policy should exist if the response is HTML\n- frame-ancestors should be in CSP or X-Frame-Options should exist if the response is HTML\n- X-Content-Type-options should be \"nosniff\"\n- Referrer-Policy should be set\n- X-XSS-Protection header should not exist\n- HTML should start with \"\u003c!doctype html\u003e\"\n- `\u003chtml\u003e` tag should include lang\n- HTML should include meta charset tag\n- HTML should include `\u003ctitle\u003e`\n- HTML should include link with rel=\"icon\"\n- HTML should not use schemeless urls for links or hrefs\n- HTML should not use unnecessary HTML entities\n- All script tags should use subresource integrity\n- X-DNS-Prefetch-Control should be set to off\n- CDNs should not be used for Javascript or CSS assets\n- RSS and JSON feeds should return Access-Control-Allow-Origin header\n- Cache-Control max-age should be \u003c= 86400 for HTML documents\n- Content-Security-Policy header should exist\n- Content-Security-Policy header should start with default-src 'none'\n- Content-Security-Policy must include either default-src or script-src\n- Content-Security-Policy header must not include unsafe-inline\n- Content-Security-Policy header must not include unsafe-eval\n- Content-Security-Policy header must not include report-sample\n- Content-Security-Policy header must not include report-uri\n- Content-Security-Policy header should not include report-to\n- Content-Security-Policy header should include upgrade-insecure-requests\n- Content-Security-Policy header only includes valid directives\n- At least two nameservers should be configured\n- Cross-Origin-Resource-Policy should be \"same-origin\"\n- cross-origin-opener-policy should be \"same-origin\"\n- Cross-Origin-Embedder-Policy should be \"require-corp\"\n- Report-To Header must not be included in response\n- Response should not contain hints of a Cloudflare captcha page\n- Response should not contain hints of a Kasada error page\n- Response should include a Content-Type\n- Response should be gzipped\n- Content-Type header should contain charset\n- Expires header should not be used without Cache-Control\n- Cache-Control header should be included in the response\n- P3P header is deprecated and should not be returned\n- SPF TXT record should exist\n- SPF TXT record should contain \"-all\"\n- SPF DNS record is deprecated and should not exist\n- SPF includes use less than 10 DNS requests\n- DMARC record should exist\n- DMARC record should contain p=reject\n- SPF should be \"v=spf1 -all\" if there are no MX records or MX record is \".\"\n- Robots.txt exists and is a text file\n- Security.txt exists and is a text file that contains required attributes\n- Security.txt has an expiry date in the future\n- Favicon is served at /favicon.ico\n- Headers that leak information should not be in the response\n- SSL certificate should be trusted\n- SSL expiry should be less than one year\n- SSL expiry should be greater than five days\n- SSL connection fails when using TLS 1.1\n- SSL connection fails when using TLS 1.0\n- DNS CAA should be enabled\n- DNS CAA should include accounturi\n- DNS CAA should include validationmethods\n- Response should be a 200 (after redirects)\n\n\n\n## Other Tools\n\nThis tool overlaps with a bunch of other online site checking tools.\nHere's a few that I have used in the past:\n\n- https://webhint.io/\n- https://pagespeed.web.dev/\n- https://internet.nl/\n- https://www.ssllabs.com/ssltest/\n- https://securityheaders.com/\n- https://csp-evaluator.withgoogle.com/\n- https://observatory.mozilla.org/\n- https://tools.pingdom.com/\n- https://web-check.xyz/\n","funding_links":[],"categories":["Python"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsesh%2Fready","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsesh%2Fready","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsesh%2Fready/lists"}