Swift·Cap

Security check / Web security check

Web security check

We make a single HTTPS request to your home page and analyse the headers that come back. Those headers determine the protections the browser applies to every one of your visitors. A result in seconds, with the exact fix for each missing item.

Passive analysis: no intrusion, no port scanning, no exploitation attempt. Test only a domain you own or are authorised to test.

Security scan — free

Passive checks only — no intrusion. By starting the scan you confirm you own the domain or are authorised to test it.

What we check

  • Encryption and HSTS

    Does the site answer over HTTPS, and does it force the browser never to attempt a cleartext connection again?

  • Content Security Policy

    Is a CSP published, and does it remain effective (without `unsafe-inline` or `unsafe-eval`)?

  • Clickjacking and MIME type

    Can your site be framed by a third-party domain, and does the browser respect the declared file types?

  • Cookies

    Do the cookies set on the home page carry the `Secure` and `HttpOnly` attributes?

  • Referrer policy and permissions

    Do your internal URLs leak to third-party sites, and are the browser's sensitive capabilities restricted?

  • Version disclosure

    Do your headers announce the exact version of the server software, which steers an automated attack?

These checks cover the server's public configuration. They cover neither application logic, nor authentication, nor dependencies: a full audit remains a separate exercise.

Also check DNS and email deliverability