Passive security header scanner
See how well a website is hardened, in seconds.
Enter a public web address. WebSecure loads it in a real browser, reads the security headers and cookie settings the server sends back, and tells you what is missing and how to fix it.
Free. Read-only. No attacks, no exploitation, no scanning of ports or files.
What WebSecure checks
Eight checks, weighted to a score out of 100. Each result shows the value the server actually sent.
- 1
Content-Security-Policy
Limits where scripts can load from, which reduces cross-site scripting. Worth 20 points.
- 2
Strict-Transport-Security
Tells browsers to use HTTPS only, which blocks downgrade attacks. Worth 15 points.
- 3
Framing protection
X-Frame-Options or frame-ancestors stop other sites from embedding the page. Worth 15 points.
- 4
Cookie security
Secure and HttpOnly flags keep cookies off plain HTTP and away from scripts. Worth 15 points.
- 5
X-Content-Type-Options
Stops browsers from guessing a file's type. Worth 10 points.
- 6
Referrer-Policy
Controls how much of a page address is shared with other sites. Worth 10 points.
- 7
Permissions-Policy
Turns off browser features such as camera and microphone that a page does not need. Worth 10 points.
- 8
Information disclosure
Flags headers that reveal exact software versions. Worth 5 points.
How it works
- Create a free account. It is only used to keep your scan history private to you.
- Enter a public web address. Private and internal addresses are refused.
- Read the report. You get a score, a rating from Strong to Minimal, the evidence for each check, a fix for each problem and a PDF you can download.
What it is
A configuration check. It looks at one response from one page and reports how its security headers are set.
A missing header is a hardening finding, not proof that a site can be attacked.
What it is not
It is not a vulnerability scanner or a penetration test, and it does not try to break into anything. The score rates headers only, and many well-run sites score low because they protect themselves in other ways.
About this project
WebSecure is a student project built to show how security headers work. It stores only your name, email, a hashed password and your scan results. Read the Terms of Service and Privacy Policy for the details.