Three small Node.js CLIs, each pulled out of the TrustYourWebsite scanner so you can run one check on its own. No build step, no dependencies, and every one exits non-zero on failure so it drops straight into CI.
Grades HSTS, CSP, X-Frame-Options, Referrer-Policy and the rest from A+ to F, and tells you what each missing header exposes.
npx @trustyourwebsite/security-headers
Validates SPF, DKIM, DMARC, BIMI and MTA-STS, with recursive SPF lookup counting and automatic DKIM selector discovery.
npx @trustyourwebsite/dns-auth-check
Clicks "Reject All" in a real browser, waits, then checks which tracking cookies and requests survived the rejection.
npx @trustyourwebsite/cookie-consent-validator
Each CLI covers a single check. The hosted scanner runs all of them across every page, plus accessibility, TLS and policy text, and returns one report. Free risk score, paid report for the finding-level detail. Technical analysis, not legal advice.