See how a URL responds: the HTTP status code, any redirects and which security headers are present. A quick way to assess the basic security and availability of a website.
What this tool does
The tool fetches the URL through a secure proxy, follows the redirects and reads the important security headers such as HSTS, CSP and X-Frame-Options.
How to use it
Enter the full URL (with https) and run the check. You see the final status and which protective headers are missing.
Input and output
- Input: a full URL
- Output: the status code, the redirect chain and the security headers present
Limitations
Fetching runs through a server proxy; page content that only loads with JavaScript in the browser is not executed or assessed.
Good to know
Missing security headers are rarely an acute vulnerability, but together they determine how well a site is protected against known attacks. Start with HSTS and a strict Content-Security-Policy, because those two deliver the biggest gain.