Check for security headers and at least

• X Frame Options

• X-XSS header

• HSTS header

• CSP header

• Referrer Policy

• Cache-Control

• Public key pins

Broken Cryptography

• Cryptography Implementation Flaw

• Encrypted Information Compromised

• Weak Ciphers Used for Encryption

Web Services Testing

• Test for directory traversal

• Web services documentation disclosure Enumeration of services, data types, input types boundaries and limits