Check a website
Inspect its homepage response. Understand what needs a closer look.
Browser defences
Baseline checks for CSP, HSTS, embedding protection, MIME sniffing, referrer policy and browser feature permissions.
YOUR RESPONSE SNAPSHOT
Security posture report
Compare & export
Import a baseline
These controls only prepare the form. Confirm permission and verification, then submit. A fresh request is not a guarantee of an origin-server response; upstream caches may still apply.
Findings
No findings match this filter.
Request flow & redirect destinations
Prioritised next actions
Report limitations
A baseline met is not a security guarantee. These observations describe one public homepage response.
Fix, then compare — import a baseline
Fix, then compare
Local comparison only. Baselines stay in page memory until cleared or this page closes. No upload or automatic browser storage. Run a new check for the same domain to compare.
No baseline loaded.
About this check — scope & privacy
A LIGHT TOUCH, NOT A PENETRATION TEST
Know what’s being checked.
Cookie hygiene
Review Secure, HttpOnly and SameSite attributes on cookies returned by the homepage. Cookie values are never included in reports.
Transport behaviour
Fetch the HTTPS homepage and check whether HTTP redirects directly to HTTPS on the same host. No redirect chains or page crawling.
Useful evidence. Honest boundaries.
A passing check is not proof that your site is secure. Policies need application context, and bot challenges may hide your real response. We do not inspect page content, run scripts, test logins or audit TLS configuration.
Reports, including selected security-header evidence, may be cached for up to five minutes in Cloudflare’s edge cache; they are not saved in an application database. Cookie values and CSP nonce values are redacted. Optional Cloudflare Turnstile is used when enabled. Domains are sent to Cloudflare’s DNS resolver and requested by this service; infrastructure providers may retain operational metadata. Your IP is used for abuse prevention. Downloads stay on your device.