Website security
Inspect certificates, response policies and the links you are about to trust.
Tools by subcategory
12 focused tools, with an explanation and a practical guide for each check.
TLS & HTTPS
Inspect certificate trust and understand Strict-Transport-Security settings.
TLS certificate inspector
Inspect a live TLS handshake: certificate chain, expiry, hostname match, protocol and cipher.
Server-side requestWeb securityHSTS policy analyser
Parse Strict-Transport-Security and inspect max-age, includeSubDomains and preload intent.
Local analysisHeaders, cookies & policies
Read response headers and examine CSP, cookies, CORS, referrer and permission policies.
HTTP security headers
Inspect a live response for HSTS, CSP, framing rules and other browser security policies.
Server-side requestWeb securityContent Security Policy audit
Parse a pasted CSP, inspect effective fallbacks and identify permissive script policies.
Local analysisWeb securityCookie security audit
Check pasted Set-Cookie headers for Secure, HttpOnly, SameSite and cookie prefix rules.
Local analysisWeb securityReferrer-Policy analyser
Identify the effective recognised Referrer-Policy token and explain its cross-origin behavior.
Local analysisWeb securityPermissions-Policy analyser
Read feature allowlists from a pasted Permissions-Policy response header.
Local analysisWeb securityCORS header analyser
Inspect pasted Access-Control response headers for wildcard, credential and cache pitfalls.
Local analysisURLs & web integrity
Inspect links, encode URL components, generate SRI values and review security.txt.
Suspicious URL inspector
Reveal misleading authority, punycode, tracking parameters and encoded URL components.
Local analysisWeb securityURL component encoder
Encode or decode a UTF-8 URL component with strict percent-escape validation.
Local analysisWeb securitySubresource integrity generator
Create a SHA-256, SHA-384 or SHA-512 integrity token from a local JavaScript or CSS file.
Local analysisWeb securitysecurity.txt validator
Review pasted security.txt fields, expiry and disclosure contact information.
Local analysis