Free Web and API Security Posture

Check What Your Site Tells The Internet.

Your transport security, response headers, cookie flags and a short list of files that should never be public — read from the outside, the way an attacker would first look at you.

This one connects to your site. Unlike the domain review, which only reads public DNS, this makes real requests to the address you enter. They are ordinary requests, there are no more than these, and nothing is submitted, guessed or enumerated:
  • GET https://<site>/ — headers, cookies, certificate
  • GET http://<site>/ — whether plain HTTP redirects
  • GET https://<site>/ — with an Origin header, for CORS
  • GET https://<site>/.git/HEAD — whether the repository is published
  • GET https://<site>/.env — whether the environment file is published
  • GET https://<site>/.well-known/security.txt
  • Two TLS handshakes pinned to TLS 1.0 and TLS 1.1