Everything your domain publishes, read back to you.
An attacker starts where you cannot see: the headers you forgot to send, the protocol you never disabled, the staging host in a certificate log. This reads all of it from the outside, the same way they would.
What it finds
Pick a check. See what it actually returns.
Real output shapes from the scanner — evidence line, severity, confidence, and the fix. Hover, click, or use the arrow keys.
Looks for
- Strict-Transport-Security
- X-Content-Type-Options
- X-Frame-Options
- Referrer-Policy
- Permissions-Policy
Example output
Missing HTTP Strict-Transport-Security (HSTS) header
high- Evidence
- Response from https://example.com/ contained no Strict-Transport-Security header.
- Recommendation
- Send Strict-Transport-Security with a max-age of at least 31536000 and includeSubDomains, so a browser that has seen the site once refuses to downgrade to plaintext.
Confidence · ConfirmedClassification · CWE-319
Boundaries
What it will never do to your site.
A scanner you cannot safely point at production is a scanner you will not run. The limits are the feature.
Safe to run on production
Every check above is the traffic a browser already generates — a request, a handshake, a DNS lookup. Nothing is fuzzed, nothing is brute-forced, no payload is submitted.
Active checks need proof of ownership
Exposure checks that probe for files like .git or .env stay locked until you prove the domain is yours with a DNS TXT record or a file served from a well-known path.
Rate-limited and bounded
Response bodies are read up to a cap, every external call carries a timeout, and scan submissions are limited per account, so an assessment cannot become a load test.
Keep reading
Where most people go next
Field notes on web security
All articles
The subdomain nobody remembered
In 2023 a marketing team pointed a subdomain at a cloud app. In 2024 the app was deleted. The DNS record wasn't. In 2026, a stranger claimed it.
What your website tells a stranger before they load the page
Before a single pixel appears, your server has already made a statement about how seriously it takes security. Attackers read it first — here's how to read yours.
The CSP that killed our own form (a production-only Next.js bug)
The forgot-password form is not working at all. Not "it's slow." Not "I got an error." Not working at all. So we did what you do. Checked the error tracker: clean. Checked the…
Read your own surface first.
One domain, free, no card. You will know within a scan whether this tells you something you did not already know.
Start free assessment