Website Security Tools
Everything you need to check and harden a site you run - 40 tools, arranged in the order you would actually work through them. Start with the full audit, then use the focused tools to fix what it finds.
Start here
One passive scan across every check below, scored and prioritised.
Website Security Audit
Run one passive scan that combines headers, HTTPS and TLS, the certificate chain, CSP, cookies, CORS, DNS security, email authentication, redirects and mixed content into a single scored report with prioritised fixes.
Website Security Regression Checker
Compare two website security audits and see exactly which controls improved, stayed the same or regressed, with the severity change for each one.
Website Security Score Comparator
Compare the security posture of up to five sites you are authorised to test, normalised by category so the differences are meaningful rather than cosmetic.
Content Security Policy and Trusted Types
The controls that decide what a page is allowed to load and execute.
CSP Generator
Build a Content-Security-Policy directive by directive, with strict and starter presets, nonce and hash support, live syntax validation and ready-to-paste server configuration.
CSP Report Analyzer
Load csp-report or Reporting API violation data and group it by directive and source, separate genuine blocks from extension noise, and see which policy changes the evidence actually supports.
CSP Nonce and Hash Generator
Generate cryptographically secure CSP nonces and SHA-256, SHA-384 or SHA-512 hashes for inline script and style blocks, with the matching policy fragment.
Trusted Types Readiness Checker
Scan HTML and JavaScript for the DOM sinks Trusted Types governs - innerHTML, document.write, eval and the rest - and see how much work enforcement would take.
Trusted Types Policy Builder
Build a Trusted Types policy skeleton and the CSP directives that enforce it, with a report-only rollout plan and framework-specific notes.
Framing, cookies and CSRF
Session handling and the boundaries around your pages.
Clickjacking Protection Tester
Check whether a page can be framed by another site, by reading CSP frame-ancestors and X-Frame-Options together and reporting which one actually applies.
Iframe Sandbox Policy Builder
Pick the capabilities an embedded frame genuinely needs and get the minimal sandbox attribute, with warnings for the token combinations that quietly undo the sandbox.
Secure Cookie Builder
Compose a Set-Cookie header for a real scenario - first-party login, cross-site embed, shared subdomain - and have Secure, HttpOnly, SameSite, Domain, Path and prefix choices checked against it.
Website Cookie Inventory Scanner
Inventory the cookies a page sets on a plain visit, with every attribute, scope and lifetime laid out, and flags separated clearly into what was observed and what was inferred.
CSRF Defense Configuration Checker
Work through how your app actually defends against cross-site request forgery - cookie attributes, tokens, origin checks - and find the gap between what you think is set and what is.
Cross-origin policy
COOP, COEP, CORP and CORS - individually, then as one compatible set.
Cross-Origin Opener Policy Checker
Check a page's Cross-Origin-Opener-Policy, what it isolates it from, and what will break if you tighten it.
Cross-Origin Embedder Policy Checker
Check Cross-Origin-Embedder-Policy and understand which embedded resources must carry CORP or CORS headers before it can be enforced.
Cross-Origin Resource Policy Checker
Check the Cross-Origin-Resource-Policy on a resource and see whether it matches the way that resource is actually embedded.
Cross-Origin Policy Bundle Generator
Generate a compatible COOP, COEP, CORP and CORS set for a stated goal - cross-origin isolation, third-party embeds, a public API, a CDN - with conflicts called out before you ship them.
Transport, redirects and server exposure
How requests reach you, and what your server volunteers about itself.
Redirect Chain Security Analyzer
Follow a redirect chain hop by hop and see HTTPS downgrades, cross-domain jumps, credential-carrying URLs, caching problems and excessive hops in one diagram.
HTTP Methods Exposure Checker
Ask a server which HTTP methods it advertises, using only OPTIONS and HEAD, and read what the answer means for risk - no state-changing request is ever sent.
Server Banner Exposure Checker
See exactly which software names and version numbers a site volunteers in its response headers, and get the configuration lines that stop it.
Third-party code and supply chain
Everything your pages load from somewhere else, and what it costs you.
Third-Party Script Risk Analyzer
List every external script a page loads with its origin, loading strategy, SRI status and referrer exposure, so supply-chain risk is visible rather than assumed.
External Resource Inventory
Inventory every script, stylesheet, font, frame, image and connection hint a page pulls in, split by first and third party, and export it as CSV or JSON.
JavaScript Source Map Exposure Checker
Find out whether a site publishes the source maps its bundles reference, which would put original source and comments within reach of anyone.
Client-Side Secret Exposure Checker
Scan JavaScript, config or any pasted text for API keys, tokens and credentials using high-confidence patterns plus entropy, with every match masked and nothing uploaded.
Vulnerable JavaScript Library Checker
Identify the front-end libraries and versions a page or manifest uses and match them against published advisories, with the evidence for each identification shown.
Website Dependency Inventory
Consolidate the client-side dependencies a site actually loads into one inventory with origins, versions where they can be proven, and an honest uncertainty label on the rest.
Certificates and TLS
The certificate layer, its revocation metadata and the configuration behind it.
Certificate Transparency Search
Search public Certificate Transparency logs for every certificate issued for a domain, with issuers, subject alternative names, validity windows and renewal patterns.
OCSP Status Checker
Find the OCSP responder a certificate names, check whether the server staples a response, and see the revocation status when it can be determined.
CRL Distribution Point Checker
Read the CRL distribution points a certificate publishes and check they resolve, with a clear statement of what CRL data can and cannot tell you.
TLS Cipher Suite Analyzer
See the TLS version and cipher suite a server negotiates, graded for forward secrecy, authenticated encryption and deprecated primitives.
TLS Configuration Generator
Generate a modern or intermediate TLS configuration for Nginx, Apache, IIS, ASP.NET Core or Node, with the client compatibility each profile costs you stated up front.
Certificate and Private Key Matcher
Confirm a certificate and a private key belong together before you deploy them. Both stay in your browser - the key is never uploaded.
CSR Decoder and Validator
Decode a certificate signing request locally to check the subject, SANs, key type and strength, and verify its self-signature, before a CA rejects it.
DANE TLSA Generator and Validator
Generate or check a TLSA record for DANE, with usage, selector and matching type explained and the DNSSEC requirement stated plainly.
APIs and file uploads
The two surfaces that carry the most risk per line of configuration.
OpenAPI Security Auditor
Audit an OpenAPI 2, 3 or 3.1 document for unauthenticated operations, sensitive parameters, insecure server URLs and missing limits, and get a per-endpoint risk table.
GraphQL Schema Security Auditor
Review a GraphQL schema or introspection result for exposed mutations, unbounded lists, missing depth limits and sensitive field names - by reading it, never by querying a live endpoint.
File Upload Security Policy Builder
Turn upload requirements into a concrete policy - allowed types, size caps, storage, renaming, Content-Disposition, authorisation - with framework snippets that verify on the server.
MIME Type and Magic Byte Checker
Compare a file's extension, its declared MIME type and its actual signature bytes to see whether they agree, with a hex preview and a polyglot warning.
Fixing and reporting
Turning findings into work someone can do, and into something you can send.
Website Security Remediation Plan
Turn audit findings into a plan someone can work: owner, effort, priority, due date, verification step, quick wins first - exported as Markdown or CSV.
Website Security Audit Report Builder
Build a presentable security report from audit data - scope, executive summary, evidence, remediation - as print-ready HTML, Markdown or JSON, with a check for sensitive fields before you share it.
The checkers this suite builds on
Long-standing A2Z.Tools checkers that the audit orchestrates rather than replaces.
How to work through a website security review
Start with the Website Security Audit. It runs every passive check in this suite against one address and gives you a scored report with the findings ordered by what actually matters, so you are not guessing where to begin.
Then work down. Transport comes first, because a site served over a downgraded or mixed connection makes every other control unreliable. Headers and Content Security Policy come next, since they are usually the largest improvement for the least deployment risk. Cookies and cross-origin policy follow, then third-party scripts - which is where most sites carry risk they never chose. The certificate layer and API surfaces come last, not because they matter less, but because they change least often.
Roll policies out in report-only mode first
Content Security Policy and Trusted Types can both break a working site instantly if you enforce a
policy you have not measured. Both support a report-only mode that tells you what
would have been blocked without blocking it. Use
CSP Generator to build the policy, deploy it as
Content-Security-Policy-Report-Only, collect real traffic, then feed the reports into
CSP Report Analyzer before you enforce anything. The same applies
to cross-origin isolation, which can break embeds and third-party widgets the moment it is turned on.
What a passive audit cannot see
These tools read what a site shows an ordinary visitor. They do not authenticate, submit forms, guess paths or attempt exploitation, which means they cannot find broken access control, injection flaws, business logic problems, or anything that only appears after login. A clean report here means the public configuration looked right - it is a floor, not a ceiling. Application-level assurance needs code review and authorised testing, which is work for people, not a scanner.
Only test sites you are responsible for
Every check here is passive and read-only, and none of it is more intrusive than visiting the site in a browser. Even so, these tools exist for reviewing your own systems and those you have been asked to review. Comparison features are built around that assumption deliberately: they compare sites you choose, and they do not publish rankings or league tables of anyone else's.
Related Tools
More tools in the same category
Other Tools
Popular tools from across A2Z
Rate this tool
Was this tool useful? Your feedback helps us improve it.