SECURITY TOOLS

SECURITY
CHECKER

Audit your HTTP security headers, HTTPS configuration, and common vulnerabilities in seconds. Know exactly where you're exposed before attackers do.

CHECK SECURITY →
WHAT WE AUDIT
✓
HTTPS / TLS
Verifies your site enforces HTTPS and uses a valid, non-expired TLS certificate. HTTP sites get browser warnings and ranking penalties.
✓
HTTP Strict Transport Security (HSTS)
Checks the Strict-Transport-Security header that forces browsers to always use HTTPS. Critical for preventing SSL-stripping attacks.
✓
Content Security Policy (CSP)
Audits your CSP header to detect XSS vulnerabilities. A missing or weak CSP leaves your users exposed to script injection attacks.
✓
X-Frame-Options
Checks this header to prevent clickjacking attacks. Without it, attackers can embed your site in an iframe and steal clicks.
✓
X-Content-Type-Options
Verifies the nosniff directive that prevents browsers from MIME-sniffing responses away from the declared content-type.
✓
Referrer-Policy
Checks how much referrer information is sent with cross-origin requests. Missing policy can leak sensitive URL parameters to third parties.
✓
Permissions-Policy
Audits the Feature-Policy/Permissions-Policy header controlling access to browser APIs like camera, microphone, and geolocation.
✓
Server Header Disclosure
Checks if your server reveals technology details in the Server header. Attackers use this to target known vulnerabilities.
✓
Mixed Content
Detects HTTP resources loaded on HTTPS pages — scripts, images, and stylesheets. Mixed content breaks security and triggers browser warnings.

Security headers most sites get wrong

HTTP security headers are the cheapest security wins available to any website. They're a few lines of config — one afternoon of work — and they protect against entire classes of attacks. Yet in our scans, over 70% of websites are missing at least three critical headers.

The most common gap is CSP — Content Security Policy. A properly configured CSP prevents cross-site scripting (XSS) attacks by specifying which sources are allowed to load scripts, styles, and media. Without it, any injected script runs with full privileges. With it, the attack fails.

HSTS is the second most missed. Without it, a user who types "yoursite.com" in their browser makes an initial unencrypted HTTP request before being redirected to HTTPS. That window is enough for an SSL-stripping man-in-the-middle attack. HSTS eliminates that window entirely.

Our security checker reads your HTTP response headers directly and cross-references them against current OWASP recommendations. You get a pass/fail report with exact header values you need to add, plus context on what each one protects against.

Is your site secure?

FIND OUT FREE →