I have been using it for a long time n8n to automate various processes, both in my daily work and in my personal projects.
It is a platform that I find extremely versatile: it allows you to create complex workflows by integrating APIs, cloud services, monitoring systems and, more recently, even artificial intelligence models.

Among the various flows I have experienced, the one that has given me the most satisfaction is the Website Security Auditor, based on a public template available on n8n.io.
This is a workflow that performs a automatic website security audit, using AI to analyze headers, configurations, and client-side code, and then send a detailed report via email.

Safety as a priority

The security of my sites—and especially that of my visitors—has always been a priority.
Even though my projects do not handle logins, payments, or sensitive data, I consider it essential to prevent common attacks and vulnerabilities such as:

• Cross-Site Scripting (XSS)
• Content Injection or Clickjacking
• Incorrect HTTPS configurations
• Lack of essential security headers

These issues can not only compromise the user experience, but in some cases allow malicious users to exploit my sites as attack vectors against others.
Automating security checks allows me to maintain a constant level of protection without having to run manual tests with every update.

How the workflow works

The flow starts simply: I enter the URL of the site to analyze and n8n performs a series of automatic steps:

1. Do the content fetch and of the HTTP header of the site.
2. Pass the data to two AI modules (based on GPT-5) that perform:
   • a’security configuration analysis (HTTP headers, cookies, CSP, HSTS, etc.);
   • a’HTML and JavaScript content analysis, to identify client-side vulnerabilities.
3. The results are aggregated and transformed into a professional HTML report, with a safety score (from F to A+) and concrete suggestions for correction.
4. Finally, the workflow automatically send the report via email, complete with graphs and colored sections for immediate reading.

It's a system non-invasive, which analyzes only public information on the site and provides a clear picture of its security level.

From initial problems to concrete improvements

When I ran the first tests on paoloronco.it, the initial scores were quite low (class D).
By analyzing the results and following the recommendations generated by the report, I implemented various Cloudflare Rules to add missing security headers, such as:

• Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
• X-Content-Type-Options: nosniff
• X-Frame-Options: SAMEORIGIN
• Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=()
• Referrer-Policy: strict-origin-when-cross-origin

After these changes, the score went up to TO-, with a solid configuration and in line with best practices.

I applied the same logic to my other projects as well, including static ones on Vercel, via the file vercel.json, so you can easily extend protection to subdomains as well.

Small technical challenges

The only limitation found concerns the large sites, where the “Security Vulnerabilities Audit” analysis module can fail for inputs too long (token limit) or timeout.
To mitigate this, I'm considering segmenting the analysis or switching to a version of the model with extended context, so I can maintain automation even across more complex domains.

An ally in security

This experiment with n8n confirmed to me how powerful automation can be even in the field cybersecurity.
A well-designed flow allows you to:

• proactively detect vulnerabilities,
• standardize security checks,
• and above all, integrate AI into daily auditing processes.

For me it has become a little routine tool, useful for ensuring that my sites remain secure, up-to-date and compliant with best web security practices — without wasting time on repetitive checks.

Sample Security Report: