01 · URL
Open the page in a browser
We load the URL, follow redirects and record server responses, cookies and page resources.
Website security check: HTTPS and CSP
Check HTTPS, security headers, cookie settings and external resources for one page. Get evidence and priorities for reviewing configuration; this passive scan does not replace a penetration test.
How it works
From URL to recommendations
02 · HTTPS / CSP
Check security settings
Review HTTPS, response headers and Content Security Policy (CSP), which restricts permitted resource sources. Cookie and external-resource findings describe what was observed during this page load.
03 · 0–100
Get a clear report
Start with a specific finding, such as an absent Content-Security-Policy header. Review permitted sources with the developer, test the change and repeat the scan. A score is not a guarantee that the application is secure.
What we check
Five categories and a fix plan
HTTPS
Transport
HTTPS, HSTS, and mixed content protection
HEADERS
Headers
Security response headers
CSP
CSP
Content Security Policy configuration
COOKIES
Cookies
Cookie security attributes
SRI / CORS
Subresources
Subresource Integrity and CORS
0–100
Recommendations
Start with a specific finding, such as an absent Content-Security-Policy header. Review permitted sources with the developer, test the change and repeat the scan. A score is not a guarantee that the application is secure.
Security audit questions
Security audit questions
A passive check of the loaded page configuration. Findings require context and do not replace a penetration test.
What does the security scanner check?
It audits HTTPS setup, security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy), cookie flags, CORS configuration, and Subresource Integrity. The scanner is passive — no attack traffic is sent to your site.
How often should I run a security audit?
Repeat the check after changes to the web server, CDN, authentication or response headers. Compare the same URL and conditions; choose any ongoing review schedule to match the application and its risks.
Does this replace a full penetration test?
No. The scanner catches configuration gaps and missing hardening, but a penetration test examines business logic, authentication flows, and deeper attack surfaces that automated scans cannot cover.
Related services
What to check next to this service
HTML check
Find HTML errors and an overly complex page structure. The report identifies the affected elements.
OpenAccessibility
Find accessibility issues with an automated check. Get recommendations; a full accessibility assessment also needs manual checks.
OpenJavaScript check
Check JavaScript files, loading errors, and code unused during loading. Find scripts that need further investigation.
OpenCSS audit
Find large stylesheets, duplicates, and styles unused during loading. Unused styles may still be needed on other pages or after user actions.
Open