WebSecure

Passive security header scanner

See how well a website is hardened, in seconds.

Enter a public web address. WebSecure loads it in a real browser, reads the security headers and cookie settings the server sends back, and tells you what is missing and how to fix it.

No account needed to scan. Create a free account to download the PDF report and keep your history. Read-only: no attacks, no port or file scanning.

Scanning the website

Loading the page in a real browser and reading its security headers. 0s

What WebSecure checks

Eight checks, weighted to a score out of 100. Each result shows the value the server actually sent.

  1. 1

    Content-Security-Policy

    Limits where scripts can load from, which reduces cross-site scripting. Worth 20 points.

  2. 2

    Strict-Transport-Security

    Tells browsers to use HTTPS only, which blocks downgrade attacks. Worth 15 points.

  3. 3

    Framing protection

    X-Frame-Options or frame-ancestors stop other sites from embedding the page. Worth 15 points.

  4. 4

    Cookie security

    Secure and HttpOnly flags keep cookies off plain HTTP and away from scripts. Worth 15 points.

  5. 5

    X-Content-Type-Options

    Stops browsers from guessing a file's type. Worth 10 points.

  6. 6

    Referrer-Policy

    Controls how much of a page address is shared with other sites. Worth 10 points.

  7. 7

    Permissions-Policy

    Turns off browser features such as camera and microphone that a page does not need. Worth 10 points.

  8. 8

    Information disclosure

    Flags headers that reveal exact software versions. Worth 5 points.

How it works

  1. Enter a public web address. No account needed. Private and internal addresses are refused.
  2. Read the report. You get a score, a rating from Strong to Minimal, the evidence for each check and a fix for each problem.
  3. Create a free account to keep it. Download the PDF and keep a private history of your scans. A scan you ran before signing up is saved to your new account.

What it is

A configuration check. It looks at one response from one page and reports how its security headers are set.

A missing header is a hardening finding, not proof that a site can be attacked.

What it is not

It is not a vulnerability scanner or a penetration test, and it does not try to break into anything. The score rates headers only, and many well-run sites score low because they protect themselves in other ways.