Automated Website Security Audit with n8n and OpenAI

I have been using n8n for some time to automate various processes, both in my day-to-day work and in my personal projects. It is a platform I find…

I have been using n8n for some time to automate various processes, both in my day-to-day work and in my personal projects.
I find it an extremely versatile platform: it makes it possible to build complex workflows by integrating APIs, cloud services, monitoring systems and, more recently, artificial intelligence models.

Of all the workflows I have experimented with, the one that has given me the greatest satisfaction is the Website Security Auditor, based on a public template available on n8n.io.
This workflow performs an automated security audit of websites, using AI to analyse headers, configurations and client-side code before sending a detailed report by email.

Security as a priority

The security of my websites - and, above all, that of their visitors - has always been a priority.
Although my projects do not handle logins, payments or sensitive data, I consider it essential to prevent common attacks and vulnerabilities such as:

Cross-Site Scripting (XSS)
Content Injection or Clickjacking
Incorrect HTTPS configurations
Missing essential security headers

These issues can not only compromise the user experience, but in some cases also allow malicious actors to use my websites as attack vectors against others.
Automating security checks allows me to maintain a consistent level of protection without having to run manual tests after every update.

How the workflow works

The workflow begins simply: I enter the URL of the website to be analysed, and n8n performs a series of automated steps:

It fetches the content and the website’s HTTP headers.
It passes the data to two AI modules (based on GPT-5) that perform:
- an analysis of the security configuration (HTTP headers, cookies, CSP, HSTS, etc.);
- an analysis of the HTML and JavaScript content to identify client-side vulnerabilities.
The results are aggregated and turned into a professional HTML report, complete with a security grade (from F to A+) and practical remediation recommendations.
Finally, the workflow automatically sends the report by email, including charts and colour-coded sections for quick and easy review.

It is a non-invasive system that analyses only publicly available information from the website and provides a clear overview of its security posture.

From initial issues to tangible improvements

When I ran the first tests on paoloronco.it, the initial scores were fairly low (a D grade).
After analysing the results and following the recommendations generated by the report, I implemented several Cloudflare Rules to add missing security headers, including:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=()
Referrer-Policy: strict-origin-when-cross-origin

After these changes, the score rose to A-, reflecting a robust configuration aligned with best practices.

I applied the same approach to my other projects, including static websites hosted on Vercel, through the vercel.json file, making it easy to extend the same protection to subdomains as well.

Minor technical challenges

The only limitation I encountered concerns large websites, where the “Security Vulnerabilities Audit” analysis module may fail because of overly long inputs (token limit) or timeouts.
To mitigate this, I am considering splitting the analysis into segments or switching to a model version with an extended context window, so that the automation can also be maintained for more complex domains.

A security ally

This experiment with n8n confirmed for me just how powerful automation can be in cybersecurity as well.
A well-designed workflow makes it possible to:

proactively detect vulnerabilities,
standardise security checks,
and, above all, integrate AI into day-to-day auditing processes.

For me, it has become a small but valuable routine tool, helping ensure that my websites remain secure, up to date and compliant with web security best practices - without wasting time on repetitive checks.

Sample Security Report:

Website Security Audit Report

Security Report Summary

Site:	https://paoloronco.it
Report Time:	October 21, 2025 at 04:50 PM
Headers:	✗ Content-Security-Policy✓ Strict-Transport-Security✓ X-Content-Type-Options✓ X-Frame-Options✓ Referrer-Policy✓ Permissions-Policy
Critical Issues:	0
Warnings:	3

Warnings

3 warnings detected

See the Configuration Issues section below for more info.

Raw Headers

Header	Status	Value
date	present	Tue, 21 Oct 2025 16:50:31 GMT
content-type	present	text/html; charset=UTF-8
transfer-encoding	present	chunked
connection	present	close
report-to	present	{“group”:“cf-nel”,
“max_age”:604800,
“endpoints”:[{“url”:“https://a.nel.cloudflare.com/report/v4?s=1yQ1J5ssSLv1SkmE6Ryid4wgzrlR3AtZbA7JA8sOJg9lH6eilgyRhGgg7o%2FbvORNExuw8i3pZ%2BdOGjAgsb3cT5WNvNn0DM9sHhwJ%2BGo%3D”}]}
link	present	`https://paoloronco.it/wp-json/`; rel=`https://api.w.org/`; alternate JSON endpoint `https://paoloronco.it/wp-json/wp/v2/pages/1251`; shortlink `https://paoloronco.it/`
server	present	cloudflare
vary	present	Accept-Encoding
x-powered-by	present	PHP/8.2.28
cf-cache-status	present	DYNAMIC
nel	present	{“report_to”:“cf-nel”,“success_fraction”:0.0,“max_age”:604800}
speculation-rules	present	”/cdn-cgi/speculation”
strict-transport-security	present	max-age=31536000; includeSubDomains; preload
content-security-policy-report-only	present	default-src ‘self’;
img-src ‘self’ data: https:;
style-src ‘self’ ‘unsafe-inline’ https:;
script-src ‘self’ ‘unsafe-inline’ https:;
font-src ‘self’ data: https:;
connect-src ‘self’ https:;
frame-ancestors ‘self’;
base-uri ‘self’;
form-action ‘self’;
upgrade-insecure-requests
permissions-policy	present	geolocation=(), microphone=(), camera=(), payment=(), usb=(), interest-cohort=()
referrer-policy	present	strict-origin-when-cross-origin
x-content-type-options	present	nosniff
x-frame-options	present	SAMEORIGIN
x-xss-protection	present	0
server-timing	present	cfCacheStatus;desc=“DYNAMIC”, cfEdge;dur=5,cfOrigin;dur=115
cf-ray	present	992241206e0ff615-MXP
alt-svc	present	h3=“:443”; ma=86400

Security Findings

Vulnerabilities

No vulnerabilities detected.

Configuration Issues

Strict-Transport-Security

This header is unknown. Value: max-age=31536000; includeSubDomains; preload.

Content-Security-Policy

This header is unknown. Value: default-src ‘self’; img-src ‘self’ data: https:; style-src ‘self’ ‘unsafe-inline’ https:; script-src ‘self’ ‘unsafe-inline’ https:; font-src ‘self’ data: https:; connect-src ‘self’ https:; frame-ancestors ‘self’; base-uri ‘self’; form-action ‘self’; upgrade-insecure-requests.

Permissions-Policy

This header is unknown. Value: geolocation=(), microphone=(), camera=(), payment=(), usb=(), interest-cohort=().

Referrer-Policy

This header is unknown. Value: strict-origin-when-cross-origin.

X-Content-Type-Options

This header is unknown. Value: nosniff.

X-Frame-Options

This header is unknown. Value: SAMEORIGIN.

X-XSS-Protection

This header is unknown. Value: 0.

Content Security Policy - ‘unsafe-inline’

The Content Security Policy allows the use of `‘unsafe-inline’` for both scripts and styles.

X-XSS-Protection

The X-XSS-Protection header is set to `0`, meaning that the browser’s built-in XSS protection is disabled.

Additional Information

access-control-allow-origin	This is a very lax CORS policy. Such a policy should only be used on a public CDN.
strict-transport-security	HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
content-security-policy	Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.
permissions-policy	Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
referrer-policy	Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
x-content-type-options	X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-frame-options	X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
report-to	Report-To enables the Reporting API. This allows a website to collect reports from the browser about various errors that may occur. You can sign up for a free account on Report URI to collect these reports.
nel	Network Error Logging is a new header that instructs the browser to send reports during various network or application errors. You can sign up for a free account on Report URI to collect these reports.
server	Server value has been changed. Typically you will see values like "Microsoft-IIS/8.0" or "nginx 1.7.2".

Implementation Guide

This report highlights security issues detected through client-side analysis. For a comprehensive security assessment, consider engaging a professional penetration tester.

To implement the fixes above:

Work with your development team to address each issue in order of criticality
Retest after implementing each fix
Consider implementing a web application firewall for additional protection

This report was automatically generated and represents an automated assessment of publicly accessible aspects of your website. For a more comprehensive security assessment, consider engaging with a professional security consultant.

---
This email was sent automatically with n8n