Register
Prelumen Analytics

Headers, HSTS, and the holes between them.

Security header, HTTPS and HSTS audit with a prioritized fix list — the baseline every website should pass.

Is this your website?
  • See which security headers are missing, and what each one prevents
  • Catch mixed content and cookies without secure flags
  • Get told what your server reveals about itself

Check the baseline

Enter a URL and get the security header, HTTPS and HSTS findings with a recommendation for each.

Security headers

Checks Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and reports what each missing header leaves open.

HTTPS and HSTS

Follows the redirect chain to confirm HTTPS is actually enforced, and reads the HSTS header for max-age, includeSubDomains and preload.

Mixed content and cookies

Finds resources still loaded over plain HTTP, and cookies set without the Secure and HttpOnly flags.

Server disclosure

Reports what the response headers give away about your server and framework versions.

Does this check my TLS certificate?
Partly. A valid certificate is reported with its issuer and remaining lifetime, a failed one with the reason — expired, self-signed, wrong hostname, untrusted chain. Revocation status and cipher suites are not inspected, and behind a CDN it is the CDN certificate, not the one on your origin.
Is this a penetration test?
No. Everything is read from the responses your server already sends to any visitor. Nothing is probed, injected or attacked.
What are the findings ordered by?
Each finding carries a pass, warning or fail badge. Start with the failures — they are the headers whose absence has a direct exploit path.
Does it check my JavaScript libraries?
Known-vulnerable frontend libraries are flagged when the vulnerability feed is available. If the feed cannot be reached, the check reports that rather than a clean result.

Every check runs on our servers: you provide a public URL, there is nothing to install, and pages are rendered with JavaScript first so single-page apps are read the same way a browser reads them. Each result gets a permanent link you can share. On a website you have claimed, findings become tracked issues, and result pages offer AI summaries and developer guidance on plans that include them.