Hardening Scan

Paste a URL. We run 42 external checks — TLS + certificate, DNS + email authentication, security headers, cookies + CORS, and NIS2 signals — and return a score out of 100 with every finding linked to the guide that fixes it.

Read-only. Same 100-point rubric as the Hardening Score self-assessment, so both tools speak the same language. Results retained 30 days; no account required; no email captured unless you opt in on the result page.

What we check

TLS & HTTPS at the edge — HTTP→HTTPS redirect, HSTS, preload eligibility, mixed content.
TLS deep — TLS 1.2 / 1.3 supported, TLS 1.0 / 1.1 refused, certificate expiry, hostname match, negotiated cipher strength.
DNS & email authentication — SPF record + strictness, DMARC record + policy, CAA record present.
Security headers — CSP (presence + quality), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP.
Cookies & CORS — Secure/HttpOnly/SameSite on any Set-Cookie; wildcard CORS on the homepage.
Subresource Integrity — cross-origin <script> and <link> tags carry an integrity= attribute.
Info leakage — Server / X-Powered-By version disclosure, cache-control on the homepage.
Vulnerability disclosure — /.well-known/security.txt per RFC 9116.
NIS2 signals — 12 checks mapped to Article 21 duties (contact path, disclosure hygiene, injection controls, published policies).