Security header scanner
Grade any site's HTTP security posture - a deep Content-Security-Policy evaluator, cookie, TLS, email/DNS and WHOIS checks, and copy-paste fixes for every finding.
We fetch only the response headers from our server (never stored), with strict SSRF protection. Public sites only - government/military and special-use domains (.onion, .local…) are out of scope.
Private by design - no accounts, no database, nothing about your scans is retained. The URL scanner runs one stateless, rate-limited request with strict SSRF protection and refuses internal, government and special-use targets. How the grade works →