A few days ago I built Onionservatory, because apparently Onion Services also deserve to be judged by automated security tools.

It answers questions like:

1
2

There are plenty of tools that will happily tell you that your normal website is terrible.

MDN HTTP Observatory will inspect your HTTP security configuration. SecurityHeaders will judge your headers.