Official foundations
Standards bodies, official documentation and public authorities are used as primary reference points.
Web resources
Security, privacy and compliance
Authorities, guidance and security tools help prioritise risks and verify safeguards. A general alert does not prove a particular site is vulnerable; its version and configuration matter.
Inventory software, versions and sensitive journeys. For each relevant advisory, check whether the installed version and configuration are affected, then assign the fix and its verification.
Browse the resourcesEditorial method
A directory made to be useful, not merely long.
Each entry has a clear role and an official destination. The catalogue avoids link farms, copied descriptions and artificial rankings.
Professional tools
Established services are grouped by actual use: building, hosting, measuring, securing, publishing or promoting a website.
Independent reading
Inclusion is editorial and unpaid. A listing does not imply a partnership or guarantee.
Compare on three practical questions
| Criterion | Question to resolve |
|---|---|
| Scope | Does the resource concern your software version and actual exposure? |
| Assessment | Is an automated score sufficient, or must access, data and logs be examined? |
| Recovery | Is there an owner, a tested backup and an incident procedure? |
Keep a short decision record: requirement, source, observed result and unresolved point. Test the same task with each candidate instead of comparing marketing lists of features.
Search and filter
Official starting points for this topic
Compare their role and documentation before selecting a tool. Inclusion is not a ranking.
50 resources displayed
No resource matches these filters. Try a broader search.
French national authority for information-system security and defense.
Use it for : Find the guidance or notice relevant to the site’s actual risk and context.
Apply it to a project
cyber.gouv.frVisit official website
French alerts, advisories and bulletins on vulnerabilities and incidents.
Use it for : Cross-check a security notice against versions actually deployed.
Apply it to a project
cert.ssi.gouv.frVisit official website
French authority for personal-data protection and GDPR.
Use it for : Consult guidance matching the actual personal-data processing.
Apply it to a project
cnil.frVisit official website
French prevention, assistance and resources against digital threats.
Use it for : Choose steps suited to the observed incident and retain the facts.
Apply it to a project
cybermalveillance.gouv.frVisit official website
Strategic monitoring, cyber risk and digital intelligence for organisations.
Use it for : Cross-check a threat analysis with primary sources before acting.
Apply it to a project
cyber-intelligence-embassy.comVisit official website
Open references and projects for Web application security.
Use it for : Use security resources as a testing basis, not proof of compliance.
Apply it to a project
owasp.orgVisit official website
Analysis of a website’s security headers and settings.
Use it for : Review flagged headers, then test their effect on the website.
Apply it to a project
observatory.mozilla.orgVisit official website
Quick check of the main HTTP security headers.
Use it for : Interpret the diagnosis against the site’s real needs and integrations.
Apply it to a project
securityheaders.comVisit official website
Check whether addresses and domains appear in known data breaches.
Use it for : Use the service within internal breach-response procedures.
Apply it to a project
haveibeenpwned.comVisit official website
Cybersecurity risk-management framework for organisations.
Use it for : Map framework functions to the organisation’s responsibilities.
Apply it to a project
nist.govVisit official website
US alerts and resources on cyber risks and infrastructure.
Use it for : Connect relevant alerts to an inventory of software in service.
Apply it to a project
cisa.govVisit official website
Dependency, container and code analysis for detecting vulnerabilities.
Use it for : Triage flagged dependencies by exposure, use and available fix.
Apply it to a project
snyk.ioVisit official website
Analysis of files, URLs, domains and security indicators.
Use it for : Interpret results cautiously and protect confidentiality of submitted files.
Apply it to a project
virustotal.comVisit official website
Public diagnostic of a Web server’s TLS configuration.
Use it for : Check the public domain’s TLS setup after a change.
Apply it to a project
ssllabs.comVisit official website
European Data Protection Board and GDPR guidance.
Use it for : Place European guidance in the context of the data processing concerned.
Apply it to a project
edpb.europa.euVisit official website
Open practical guides for applying security controls to Web applications and interfaces.
Use it for : Read the sheet matching the security control being designed or checked.
Apply it to a project
owasp.orgVisit official website
Verification standard for defining and checking application-security requirements.
Use it for : Define verification requirements that fit the application scope.
Apply it to a project
owasp.orgVisit official website
Guidance from the French authority for reducing common digital risks faced by organizations and users.
Use it for : Turn relevant recommendations into assigned responsibilities and documented checks.
Apply it to a project
cyber.gouv.frVisit official website
Official French guidance on cookies, trackers, consent and publisher responsibilities.
Use it for : Check applicable rules before choosing trackers and the consent interface.
Apply it to a project
cnil.frVisit official website
Priority CERT-FR alerts about vulnerabilities and threats requiring prompt action.
Use it for : Compare affected products and versions with your own inventory before acting.
Apply it to a project
cert.ssi.gouv.frVisit official website
Official command for checking known vulnerabilities and abandoned packages in a PHP project.
Use it for : Review dependency advisories, then check applicability and available updates.
Apply it to a project
getcomposer.orgVisit official website
Public principles for integrating security into digital-product design and defaults.
Use it for : Review design principles when product choices shift risk onto users.
Apply it to a project
cisa.govVisit official website
Technical guide to Content Security Policy for limiting resources and behaviors allowed in the browser.
Use it for : Prepare a policy matching resources actually loaded and inspect violations.
Apply it to a project
developer.mozilla.orgVisit official website
Awareness reference for major categories of Web application security risk.
Use it for : Use the list to orient a risk review, not as proof that a site is secure.
Apply it to a project
owasp.orgVisit official website
Project focused on API-specific risks, authorization controls and secure design practices.
Use it for : Review API risks against its access rules, exposed data and actual flows.
Apply it to a project
owasp.orgVisit official website
Catalog of vulnerabilities known to be exploited in the wild, useful for prioritizing remediation.
Use it for : Cross-reference listed exploited flaws with software actually installed.
Apply it to a project
cisa.govVisit official website
GitHub features for inventorying dependencies, detecting vulnerabilities and automating updates.
Use it for : Review dependencies, provenance and permissions in the software delivery process.
Apply it to a project
github.comVisit official website
Official PHP manual section covering configuration, user data, sessions and common risks.
Use it for : Check guidance for the PHP version and features actually used.
Apply it to a project
php.netVisit official website
Official recommendations for reducing risks involving dependencies, requests and Node.js execution.
Use it for : Evaluate dependencies, runtime and configuration in the application context.
Apply it to a project
nodejs.orgVisit official website
Checks selected HTTP security settings and explains the tests and their limits.
Use it for : Inspect flagged headers and test fixes without treating the grade as a complete security audit.
Apply it to a project
developer.mozilla.orgVisit official website
Automated checks of open-source project security practices, to interpret in context.
Use it for : Read detailed checks on a dependency before drawing a conclusion from its overall score.
Apply it to a project
openssf.orgVisit official website
Open vulnerability database for software packages, with searches by affected version.
Use it for : Compare an advisory with the exact package version used by the project.
Apply it to a project
osv.devVisit official website
European Data Protection Board resources on personal-data breaches.
Use it for : Find European regulator guidance for assessing a personal-data incident.
Apply it to a project
edpb.europa.euVisit official website
Official guidance on determining and documenting personal-data retention periods by purpose and applicable rules.
Use it for : Set a justified period for received enquiries, then document archiving or deletion.
Apply it to a project
cnil.frVisit official website
Explanation of cross-origin resource sharing and related browser HTTP exchanges.
Use it for : Separate cross-origin rules from API operation permissions.
Apply it to a project
developer.mozilla.orgVisit official website
Guidance for authentication design and sensitive-operation controls.
Use it for : Connect sign-in, recovery and reauthentication to service risks.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Guidance for account recovery journeys and their checks.
Use it for : Try an expired link, absent account and completed recovery using synthetic data.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Guidance for controls determining permitted actions and resources.
Use it for : Test a direct address using a restricted account.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Guidance for session protection, management and lifecycle.
Use it for : Check expiry, logout and revoked access after a role change.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Guidance for logging events, selecting data and protecting logs.
Use it for : Use synthetic markers to detect unnecessary collection of sensitive content.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Guidance for received file checks, formats, storage and permissions.
Use it for : Check content, size, access and deletion rather than trusting only a declared type.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Guidance for REST API security, exchanges and access controls.
Use it for : Associate each operation with permissions and observable refusal cases.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Explanation of values interpreted as formulas when files are opened in spreadsheets.
Use it for : Review the receiving software and exported fields before choosing safeguards.
Apply it to a project
community.owasp.orgVisit official website
Guidance for application errors and separation of user information from internal diagnosis.
Use it for : Show a useful action without exposing server traces or secrets.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Guidance for password storage mechanisms and their maintenance.
Use it for : Have the security owner review storage and migrations.
Apply it to a project
cheatsheetseries.owasp.orgVisit official website
Official documentation for validating GitHub webhook delivery signatures.
Use it for : Test altered payloads before permitting business operations.
Apply it to a project
docs.github.comVisit official website
Documentation for Dependabot alerts concerning known repository dependencies.
Use it for : Compare package, version and context before setting remediation priority.
Apply it to a project
docs.github.comVisit official website
Documentation for reviewing dependency changes in a GitHub repository.
Use it for : Review the origin and effect of dependencies introduced by a change.
Apply it to a project
docs.github.comVisit official website
Documentation for provenance linking npm publication to source and build.
Use it for : Read available evidence without turning it into a safety guarantee.
Apply it to a project
docs.npmjs.comVisit official website
Reference for PHP password hashing and verification APIs.
Use it for : Use maintained APIs and have the project’s storage mechanism reviewed.
Apply it to a project
php.netVisit official website
Choose a starting point
What each category helps you decide.
These examples illustrate uses, not rankings or endorsements. Verify each provider’s current documentation and terms before a decision.
Security, privacy and compliance
Authorities, guidance and security tools help prioritise risks and verify safeguards. A general alert does not prove a particular site is vulnerable; its version and configuration matter.
Questions to check- Separate preventive guidance from an active vulnerability notice.
- Assign who applies, tests and documents a correction.
A practical use : Inventory software, versions and sensitive journeys. For each relevant advisory, check whether the installed version and configuration are affected, then assign the fix and its verification.
What this cannot prove : A scanner or alert list proves neither safety nor compromise. Personal-data questions require an assessment tailored to the incident.
Related guide : Test website restoration before an incident
Transparency
Suggest a resource or correction
Editorial scope and third-party websites
This non-exhaustive directory was last reviewed on 30 August 2026; its links were checked on 25 September 2026. Some websites restrict automated checks. It contains external links to independent websites. Their availability, content, prices, cookies and terms may change. Française du Numérique does not control them and receives no commission for their inclusion.
Directory questions
Selection, independence and updates.
The editorial selection prioritises primary and official sources, established standards bodies, widely used professional tools, specialised media and active communities that are directly relevant to creating, operating, securing or promoting websites. An entry should have a clear purpose, an identifiable publisher and an official destination. The catalogue is independent, non-exhaustive and does not attempt to rank every available provider. Inclusion may be reconsidered when a resource closes, changes purpose, becomes misleading or no longer offers enough practical value. Review dates indicate when the catalogue was last checked as a whole, not a guarantee that every external page remains unchanged afterwards. Visitors should therefore confirm current pricing, terms, security and suitability on the third-party website before relying on a service.
No. A directory entry is a practical reference, not a certification, partnership, security audit or commercial endorsement. The listed organisations remain responsible for their products, content, prices, availability, cookies, personal-data practices and contractual terms. A resource may be useful for one project and unsuitable for another because requirements, jurisdiction, budget and technical capacity differ. Française du Numérique does not receive a commission for inclusion in this editorial directory. Before creating an account, purchasing a service or transferring data, visitors should review the official documentation, current terms, support arrangements, export options and relevant independent evidence. When the decision carries legal, financial or security consequences, an appropriately qualified assessment may also be necessary.
Yes. The search field checks resource names and editorial topics, while filters narrow the catalogue by category, geographical origin and resource type. Filtering and sorting take place locally in the browser, so the text entered in the directory search is not sent to a separate search provider. Combining several filters may produce no result even when a useful resource exists in a neighbouring category; in that case, remove one filter or try a broader term. The catalogue descriptions are deliberately concise and cannot represent every feature offered by a third party. Open the official website to confirm capabilities, documentation and current conditions before making a decision.
Use the contact page and provide the resource name, official URL, publisher, relevant category and a short explanation of its value for web professionals or project owners. For a correction, identify the entry and the information that appears inaccurate or outdated, ideally with a primary source. Suggestions are reviewed before publication and may be declined when the destination lacks a clear publisher, duplicates an existing entry, is primarily promotional, creates avoidable risk or falls outside the directory scope. Submission does not guarantee inclusion or a particular position, and paid placement is not offered through this editorial process.