Discuss your project

TOOLBOX · SECURITY CHECK

Check Security Headers.

How well does your website protect its visitors? Enter a domain, get a grade and see which line of configuration is missing.

The bot check protects the toolbox against automated abuse.

We fetch the page once, like a browser, and read what is delivered publicly. We do not store results permanently.

WHAT IS CHECKED

Small Lines.
Big Impact.

Security headers are instructions from your server to the browser. They cost nothing, are quick to set and rule out entire classes of attacks.

  • 01

    HTTPS and HSTS

    Encrypted connection, a permanent redirect from HTTP and the instruction to the browser never to connect unencrypted again.

  • 02

    Content-Security-Policy

    Defines the sources scripts may load from. The most important protection against cross-site scripting.

  • 03

    Clickjacking Protection

    frame-ancestors or X-Frame-Options prevent other sites from embedding your website invisibly.

  • 04

    Privacy Headers

    Referrer-Policy and Permissions-Policy limit what other sites learn about visitors and which device features they request.

  • 05

    Isolation

    Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy separate your site from other windows and embeds.

  • 06

    Disclosure

    Version details in the server header help attackers find known vulnerabilities in a targeted way.

QUESTIONS

Good to Know.

What does the security header check test?

It fetches the home page of your website once, like a browser, and rates the security headers of the response: HTTPS and the redirect from HTTP, the certificate, HSTS, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin headers and version details.

May I check other people’s websites?

The check only reads what the website delivers publicly to every visitor. It does not submit forms, does not probe for vulnerabilities and does not scan ports.

How is the grade calculated?

Every check has a weight. Passed counts in full, a warning counts half, a critical finding counts nothing. This gives a value from 0 to 100 and the grade A+ to F. A+ is only possible without a critical finding; if HTTPS is missing or the certificate is invalid, C is the best possible grade.

Why is a CSP with unsafe-inline only rated as a warning?

With 'unsafe-inline', injected inline scripts may run as well. The Content-Security-Policy then loses a large part of its protection against cross-site scripting. Nonces or hashes are better.

Does TOMORIS store my input or the result?

No, not permanently. The result stays in memory for five minutes so that repeated requests for the same domain do not put load on the website again, and it is deleted after six minutes at the latest. Details are in the privacy statement, section Toolbox.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result