Free website tools
Quick, focused checks for one thing at a time. Each runs in seconds with the same engine as our full audit, which checks all of them at once.
Security Headers Checker
Test HSTS, Content-Security-Policy, clickjacking protection and other HTTP security headers, and get an A+ to F grade with exact fixes.
Security · Open tool →SSL Certificate Checker
Check certificate validity, days to expiry, hostname match, TLS version, key strength and the HTTP to HTTPS redirect for any domain.
Security · Open tool →Mixed Content Checker
Find http:// scripts, styles, images and iframes on an HTTPS page, forms that post to http:// and password fields on insecure pages.
Security · Open tool →Email Security Checker (SPF, DKIM, DMARC)
Check MX, SPF and its 10-lookup limit, DKIM on common selectors, DMARC policy and reporting, MTA-STS and TLS-RPT for any domain.
Security · Open tool →HTTP Headers Checker
List every HTTP response header a page sends, with cookies shown by name, plus compression, HTTP version, server disclosure and CORS checks.
Security · Open tool →Security Headers Generator
Generate HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy and COOP for nginx, Apache or a _headers file.
Security · Open tool →SPF & DMARC Record Generator
Build an SPF record from common email providers within the 10-lookup limit, plus a DMARC record with your policy and reporting address.
Security · Open tool →Subdomain Finder
Count the subdomains on a domain's unexpired TLS certificates from public Certificate Transparency logs; verified owners see the full list.
Security · Open tool →Email Address Validator
Check that an email address is well-formed and that its domain can receive mail: MX records, null MX and the A/AAAA fallback.
Security · Open tool →SSL Certificate Decoder
Paste a PEM certificate or chain to read its subject, issuer, SANs, validity dates, key type, SHA-256 fingerprint and chain order.
Security · Open tool →CSR Generator (OpenSSL Command)
Build the OpenSSL command that creates a private key and a CSR with the right subject and SANs on your own server. The key never leaves it.
Security · Open tool →