Security Tools
Scan for common website security misconfigurations, from HTTP headers to mixed content.
10 tools in this category
All Categories
Harden the Browser Side of Your Site
Many attacks on websites are blocked by a few response headers that cost nothing to add - yet most small sites are missing several of them. The Security Headers Checker scans a page, lists which recommended headers are present and missing, and gives a score out of 100. Each header also has its own checker when you are fixing one at a time: HSTS, Content Security Policy, X-Frame-Options, Referrer-Policy and Permissions-Policy.
HTTPS Done Properly
A certificate only helps if every visitor ends up on HTTPS. The HTTPS Redirect Checker confirms http:// requests are sent to https:// with a permanent redirect, and the Mixed Content Detector finds images and scripts still loaded over plain http.
Related Tools
Cross-origin requests are covered by the CORS Header Checker. For passwords, hashes and tokens - the JWT Decoder, SHA-256 Hash Generator and Password Strength Checker - see Security & Authentication Tools. Our security headers checklist gives safe starting values for each header.