AI-Powered Website Security Auditor and Reporting - n8n Workflow

• Web Developers and DevOps Engineers needing quick security checks.


• Security consultants looking for an automated preliminary scanning tool.


• Users searching for practical n8n templates utilizing advanced AI features.


• Businesses seeking an automated solution for non-invasive website vulnerability reporting.

Maintaining website security requires constant vigilance, especially regarding configuration headers and client-side vulnerabilities like Cross-Site Scripting (XSS). This n8n workflow solves this by automating the initial, non-invasive audit phase. It leverages the power of OpenAI's large language models (LLMs) via LangChain Agents to perform expert-level analysis on both HTTP response headers and raw page content simultaneously. The workflow then applies custom logic within a specialized n8n node to calculate a security grade (A+ to F) and format all findings—including descriptions, impacts, and fix recommendations—into a professional, detailed HTML report. This highly valuable n8n template ensures that critical security information is delivered quickly and clearly via Gmail.

This comprehensive n8n workflow initiates when a user submits a URL via the dedicated web form, which acts as the initial n8n trigger.

1. Input and Scraping: The 'Landing Page Url' Form Trigger captures the target URL. The 'Scrape Website' HTTP Request n8n node then fetches the webpage content and all response headers.


2. Header Preparation: The 'Extract Headers for Debug' Code n8n node formats the raw HTTP headers into a clean string, optimizing them for LLM input.


3. Parallel AI Analysis (Configuration): The first branch sends the formatted headers to the 'Security Configuration Audit' LangChain Agent, guided by the 'OpenAI Headers Analysis' model. This AI agent analyzes headers (like CSP, HSTS, X-Frame-Options) for security misconfigurations.


4. Parallel AI Analysis (Vulnerabilities): The second branch sends the scraped HTML content to the 'Security Vulnerabilities Audit' LangChain Agent, guided by the 'OpenAI Content Analysis' model. This agent scans for client-side issues like XSS opportunities and information leakage.


5. Merging and Aggregation: The 'Merge Security Results' and 'Aggregate Audit Results' n8n nodes combine the findings from both independent AI analyses.


6. Data Processing and Grading: The 'Process Audit Results' Code n8n node is the heart of the grading logic. It parses the textual AI output, checks for the presence and validity of security headers (e.g., verifying HSTS max-age and detecting 'unsafe-inline' in CSP), determines a final letter grade (A+ to F), and structures the data into a usable object.


7. HTML Generation: The 'convert to HTML' Code n8n node transforms the structured audit data into a styled, professional HTML email report, complete with color-coded findings and visual grade indicators.


8. Delivery: Finally, the 'Send Security Report' Gmail n8n node delivers the complete security assessment report to the configured recipient.

To deploy this expert n8n workflow and start running security audits, follow these steps:

1. Import the n8n template: Copy the provided JSON data and paste it directly into your n8n instance using the 'New' > 'Import from JSON' function.


2. Configure OpenAI Credentials: The workflow requires an OpenAI API Key. In your n8n settings, create a new credential for 'OpenAI API' and enter your key.


3. Configure Gmail Credentials: Set up a 'Gmail OAuth2 API' credential to allow the 'Send Security Report' n8n node to send emails. Follow the OAuth setup instructions.


4. Update Recipient: Open the 'Send Security Report' Gmail n8n node and change the sendTo expression from the placeholder to your desired audit report delivery email address.


5. Activate: Click the 'Active' toggle in the top right corner of the n8n workflow editor. This deploys the Form Trigger URL.


6. Run: Access the provided Form URL (from the 'Landing Page Url' n8n trigger node) and submit the website URL you wish to scan.

Landing Page Url (n8n trigger): Acts as the entry point, providing a web form for users to input the target website URL.
Scrape Website (HTTP Request n8n node): Executes a non-invasive web request to retrieve the target URL's HTML content and full HTTP response headers.
Extract Headers for Debug (Code n8n node): Pre-processes the raw headers from the HTTP response, converting them into a clean, easy-to-read string for the subsequent AI analysis.
Security Configuration Audit (LangChain Agent n8n node): Uses the 'OpenAI Headers Analysis' model to act as a web security expert, focusing specifically on assessing the security of HTTP headers and cookie configurations. Its output details misconfigurations and recommendations.
Security Vulnerabilities Audit (LangChain Agent n8n node): Uses the 'OpenAI Content Analysis' model to analyze the HTML body and visible content, identifying potential client-side risks like XSS and information leakage.
Merge Security Results & Aggregate Audit Results (Merge/Aggregate n8n nodes): Ensures the results from the two parallel AI branches are collected into a single, cohesive dataset for final processing.
Process Audit Results (Code n8n node): Crucial for the workflow. This n8n node runs custom JavaScript logic to parse the AI output, calculate the final security grade (A+, A, B, etc.) based on defined criteria, and structure the data for display.
convert to HTML (Code n8n node): Generates a highly stylized and detailed HTML report template using the structured audit data, ensuring the final output is professional and readable.

• Send Security Report (Gmail n8n node): Sends the generated HTML report to the specified email address, completing the automated assessment cycle.