Tools
Website security checker
Safe, passive checks of what your website exposes to the public internet.
What we check
Transport security
- HTTPS availability
- HTTP to HTTPS redirect
Security headers
- Strict-Transport-Security (HSTS)
- Content-Security-Policy
- X-Content-Type-Options
- Clickjacking protection
- Referrer-Policy
- Permissions-Policy
Information disclosure
- PHP version disclosure
- Server software disclosure
Cookies
- Cookie security flags
Exposed files
- Git repository metadata (/.git/) — /.git/HEAD
- Environment file (/.env) — /.env
- phpinfo() page — /phpinfo.php, /info.php
- WordPress config backup — /wp-config.php.bak, /wp-config.php~
- WordPress debug log — /wp-content/debug.log
- Apache server-status page — /server-status
- macOS .DS_Store file — /.DS_Store
Disclosure policy
- security.txt
What we never do
- Exploit vulnerabilities or send attack payloads
- Guess passwords or test login forms
- Crawl the site, scan ports or fuzz paths
- Send POST requests or modify anything on your server
- Store your scan results
Built-in safety limits
Only public domains on standard ports can be checked. DNS answers and every redirect are validated so the scanner cannot be pointed at private networks, and each check has strict timeouts and response-size limits.