Security
The security basics, checked from the outside
What a page load can see: whether the connection is encrypted, whether anything on the page is not, which security headers are set, how cookies are flagged, and what third-party code the page is trusting.
Three audits every 24 hours with a free account. No card, and nothing switches off.
What it measures
Checked on every run
These are the checks an attacker makes first because they cost nothing, and the ones most sites fail for the same reason — nobody has looked. Getting them right will not stop a determined attack; leaving them wrong is an invitation.
HTTPS and mixed content
Whether the page is served over TLS, whether http:// redirects to it, and whether any image, script or stylesheet on the page is still loading insecurely.
Security headers
Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and frame protection — what is set, and what a missing one leaves open.
Cookies
Secure, HttpOnly and SameSite flags on the cookies the page sets.
Third-party code
Every external script the page executes, and whether it is pinned with Subresource Integrity. A script you do not control runs with the same privileges as one you wrote.
How it works
Three steps, about ninety seconds
Paste the address
Any public page. The engine resolves it, follows redirects and reports where it ended up.
It loads the page twice
Once at a phone viewport on a throttled connection, once on a desktop, in a real browser — not a lookup against a database of old crawls.
You get numbers, ranked
Four scores, the measurement behind each, and the problems in the order they are costing you. Results stay in your dashboard, so a re-run shows what moved.
Questions
What this does, and what it does not
- Is this a penetration test?
- No, and it is important that you do not treat it as one. This observes one page load from the outside. It does not probe, does not authenticate, does not send a single unusual request, and cannot see anything about your server, your database or your application logic. A clean result here says the front door is shut, not that the building is secure.
- Can I run it against a site I do not own?
- It will load any public page, because that is all a browser does. What it will never do is anything a visitor could not: no scanning, no probing, no form submission, no attempt to sign in. If you need more than that on somebody else’s site, you need their written permission and a different tool.
- How does the audit actually run?
- We load the page in a real browser twice — once on a simulated mid-range phone on a slow connection, once on a desktop — and record what happens. Nothing is estimated from a database of past crawls; every number comes from that load, on the day you asked for it.
- Is it free?
- Yes. Three audits every 24 hours with a free account, which exists so the engine is not run by scripts. There is no card, no trial, and nothing switches off.
Measure it now
One address, ninety seconds, and a list you can hand to whoever builds the site. If the list turns out to be longer than an afternoon, that is a conversation we are happy to have.