Audit any public URL.
Including this one.
Type an address and get one honest reading of it: the security headers it declares, the TLS it negotiated, the weight of its HTML, its robots and sitemap, and its real-user Core Web Vitals where those exist. Each line says what it means and what to change. No account, no email, no stored report.
- Rate limit
- 5 / minute · 50 / day
- Concurrency
- 3 in flight
- Refused
- private, loopback, link-local, reserved
- Kept
- nothing
Seven readings, six requests at most.
| Item | Read from | What it cannot tell you |
|---|---|---|
| Security headers | CSP, HSTS, X-Frame-Options, Referrer-Policy, nosniff, Permissions-Policy |
Whether each policy is scoped correctly — only that it is declared. |
| TLS | The handshake of the same connection | Nothing about ciphers on other ports, or about the reverse proxy in front. |
| HTML weight | Bytes counted while streaming, then dropped | What the page costs after images, fonts and scripts. |
| robots and sitemap | One presence check each | Whether what they say matches the site. Contents are not kept. |
| Field metrics | Chrome UX Report p75, when a key is configured | Anything about a page with too little traffic for a sample. |
| Grade | A count of eight declared checks, computed on the server | Whether the application behind the headers is safe. |
| Boundary | Requests issued, time spent, bytes read, redirect hops | — it is there so you can check the work rather than believe it. |
The first row is also the first thing a client or an auditor asks for, and the first thing a framework deploy leaves out. That asymmetry is the whole reason this page exists.
A reading, not a test.
A tool that reports on other people's servers owes a precise statement of what it does to them. This is it, in the same words used on the page that describes the code.
robots.txt and sitemap.xml. No link following, no subdomain discovery, no path guessing.GET. The audit cannot submit a form, trigger a job, or change a byte on a system it does not own.Eight declarations, one letter.
The letter is a count, nothing more: HTTPS, HSTS, CSP, nosniff, a framing policy, a referrer policy, a permissions policy and TLS 1.2+. The server computes it, so no two reports can disagree about the arithmetic.
| Grade | Passed | What it means | What to do |
|---|---|---|---|
| A | 8 of 8 | Every scored declaration is present. | Nothing — and re-check when a CDN or a vendor is added, because that is how headers disappear. |
| B | 7 of 8 | One declaration is missing. | Fix the one failed row; there is no pattern to redesign around. |
| C | 5–6 of 8 | Two or three missing — usually the CSP and a policy header, which is what a default framework deploy looks like. | Start with the CSP in report-only mode, then the framing policy. |
| D | 3–4 of 8 | Half or more of the declarations are absent. | Set the six headers together in one place — edge config or middleware — then run it again. |
| F | 0–2 of 8 | Most declarations are missing. The site may still work perfectly. | Put a header block in front of the app first (Netlify, Cloudflare and nginx all take one), then come back. |
Audit this deployment
Press Use this site and the form audits the deployment you are reading: HSTS with preload, an enforced CSP without unsafe-inline, nosniff, frame and referrer policies, TLS 1.3. It should come back with an A and an empty fix list. If it does not, either the deployment changed under you or the grade is wrong — and I want the report either way.
Same principle, no server
The simulator computes a queueing model in your browser and shows which tier saturates first. The status panel publishes aggregates of my own services — uptime, p95, backup state — and nothing about clients. All three exist so that claims on this site can be checked instead of believed.