Read the individual public signals and the stated limits. This check does not replace an authorized security assessment or prove that a website has no vulnerabilities.
- Public signals
- Defined scope
- Further review
How to use this tool
- Enter the public website hostname.
- Run the passive check to inspect the response headers and HTML.
- Read each observation in the context of how the application is designed and delivered.
Understanding the results
- Security headers
- Headers can control browser behavior, but the right policy depends on your application and embedded services.
- Framing controls
- Review whether the response declares framing restrictions and whether those restrictions suit the site’s legitimate uses.
- HTTP references
- References in returned HTML can flag resources or form destinations worth reviewing. Runtime JavaScript behavior is outside this check.
What this check covers
The tool sends ordinary HTTPS requests. It does not run exploits, attempt login, perform an authenticated audit or certify that a site is free of vulnerabilities. Absence of a particular header alone does not prove an exploitable flaw.
Common questions
Is this a vulnerability scanner?
It is a passive configuration check. An assessment of software vulnerabilities needs an agreed scope, suitable testing and authorized targets.
Should I copy every suggested policy into my server?
Review policies against your application first. An overly restrictive policy can break scripts, media, forms or legitimate integrations.