Configuration, not penetration testing
The checker inspects public responses and HTML only. It does not log in, submit forms, fuzz parameters or claim that a clean result proves a site has no vulnerabilities.
Website security
Review the browser-facing security configuration.
Inspect public HTTPS, headers, CSP, cookie attributes, cross-origin policy, mixed-content references and vulnerability-contact metadata in one passive check.
Result
Website security observations
What to review
Read the finding in context.
Headers and content policy
Review CSP, HSTS, framing, MIME sniffing, referrer controls, permissions policy, legacy headers and cross-origin isolation signals.
Cookie attributes
Cookie values stay private. The tool reports names and attributes such as Secure, HttpOnly, SameSite, Domain, Path and prefix consistency.
HTML observations
The bounded parser looks for HTTP references on HTTPS pages, insecure form actions, password fields on plaintext pages and cross-origin script integrity signals.