What is the first thing you check when auditing the security of a website?

MDN says its HTTP Observatory tests for measures against attacks such as cross-site scripting and insecure cookies, but does not test for outdated software versions or SQL injection vulnerabilities.
https://developer.mozilla.org/en-US/observatory/docs/faq
The full answer on why web security matters and how to audit a site is on the blog:
https://aiwebpageseo.com/blog/why-is-web-security-important-how-to-audit
Which tools or checks do you start with, and what do you usually find first?