Vulnerability data, scanning and audit services. A listing here is not an endorsement of the scanner’s accuracy.
The x-request-id response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and monito...
The cf-cache-status response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and mon...
The x-served-by response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and monitor...
The x-nf-request-id response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and mon...
The public-key-pins response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and mon...
The server-timing response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and monit...
The x-ua-compatible response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and mon...
The content-length response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and moni...
The connection response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and monitori...
The date response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and monitoring scr...
Change watch for response header strict transport security: runs the check, compares it with the result from your previous call for the same url (kept 90 days) and returns the current answer, changed true/false, the fiel...
Change watch for response header content security policy: runs the check, compares it with the result from your previous call for the same url (kept 90 days) and returns the current answer, changed true/false, the fields...
Change watch for response header content security policy report only: runs the check, compares it with the result from your previous call for the same url (kept 90 days) and returns the current answer, changed true/false...
Does https://<domain>/security.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of security.txt tells you about the site's tooling and po...
Does https://<domain>/.well-known/security.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/security.txt tells you about t...
Does https://<domain>/.env exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed .env is a security finding. $0.01 per check.
Does https://<domain>/.git/HEAD exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed .git/HEAD is a security finding. $0.01 per check.
Does https://<domain>/xmlrpc.php exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed xmlrpc.php is a security finding. $0.01 per check.
Does https://<domain>/admin/ exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed admin/ is a security finding. $0.01 per check.
Does https://<domain>/phpinfo.php exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed phpinfo.php is a security finding. $0.01 per check.
Does https://<domain>/.DS_Store exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed .DS_Store is a security finding. $0.01 per check.
Does https://<domain>/package.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed package.json is a security finding. $0.01 per check.
Does https://<domain>/composer.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed composer.json is a security finding. $0.01 per check.
Change watch for site has security txt: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed w...