Does running a scan send attack payloads or stress-test my server?

Never. Web Security Inspector is 100% passive and non-intrusive: it performs only standard browser-equivalent HTTP GET/HEAD requests, TLS handshake inspection, public DNS/DoH lookups, and keyless OSV.dev advisory matching — zero fuzzing, zero brute-forcing, and zero traffic spikes.

Are audited URLs or security scores published on any public leaderboard?

Never. To protect operational security, audited domains and findings are never listed publicly or stored in a public database. Score history for before/after comparisons is stored strictly inside your own browser's localStorage.

How can I roll out Content-Security-Policy (CSP) without breaking analytics or UI scripts?

Tab 03 auto-detects external script/font/connect origins already present on your page and generates a safe Content-Security-Policy-Report-Only configuration across 8 server/CDN stacks (Apache, Nginx, Cloudflare, PHP, WordPress, Firebase Hosting, Next.js, and DNS) so you can verify zero breakage before enforcing.

Web Security Inspector — Free 50-Point Passive HTTP Header, CSP, TLS, DNS & Secret Leak Audit

Enter any URL above and click "Run Audit"

Web Security Inspector unifies global benchmarks (Mozilla HTTP Observatory, Qualys SSL Labs, CSP Evaluator, Hardenize, OSV.dev) into a single 50-point passive posture workbench — complete with 4 compliance baselines (OWASP/IPA, Enterprise Governance, PCI-DSS v4.0, Tracker Transparency), a Quick-Win score simulator, 8-stack config snippets, and SHA-384 SRI generation ($0).

1. HTTP Headers & CSP Bypass 2. TLS 1.0–1.3 & Cert Strength 3. Runtime & .git/.env Exposure 4. WordPress & CMS Hygiene 5. JS Secret Leaks & SRI 6. SPF/DMARC/DNSSEC & Takeover 7. Third-Party Tracker Ledger

—

Overall Security Score

--/100 -

-- / 50 checks passed

Projected After Fixes

--/100 - +0 pts

Toggle priority fixes below to simulate

HTTP Observatory --

SSL / TLS Posture --

Email & DNS Trust --

Detected Stack & Edge —

Private History (Local Only) Browser-local only

7-Layer Security Breakdown

Click any row to filter the 50-check list below

Security Domain	Passed	Points	Coverage

POSTURE —

TOP FIX —

UPSIDE —

Priority Remediation Simulator (Toggle fixes to project score)

Critical Subpages Batch Audit (Login · Contact · Checkout · Privacy)

Passively audits up to 5 high-risk subpages to catch insecure HTTP form actions, missing Cache-Control on auth/contact routes, and third-party tag sprawl.

50-Point Security Checklist (Click any row for live evidence & fix)

Showing: Actionable Issues

HSTS Preload Eligibility (hstspreload.org 4-Requirement Check)

Content-Security-Policy (CSP) Directives & Bypass Gadget Analysis

Mozilla Observatory + Google CSP Evaluator baseline (detects JSONP & wildcard CDN script-gadget bypasses)

Directive	Strength	Allowed Sources

Raw HTTP Response Headers Line-by-Line Audit

Header Name	Status	Observed Value (Session cookies masked)	Security Note

Set-Cookie Attributes & Host- / Secure- Prefix Audit

Cookie Name	Secure	HttpOnly	SameSite	Path	Assessment

TLS Protocol Generation & HTTP/2 · HTTP/3 Matrix (SSL Labs Baseline)

Servers still accepting deprecated TLS 1.0 / 1.1 fail PCI-DSS v4.0 and are capped at SSL Grade B.

Email Spoofing Defense (SPF / DMARC / DKIM / MTA-STS), DNSSEC & Dangling CNAME Audit

Runtime, CMS, JS Bundle Secrets & Sensitive File Exposure Summary

Third-Party Origin & Privacy Tracker Inventory Ledger

Automatically catalogs external origins and analytics/ad vendors contacted on page load for GDPR / CCPA / Telecom Privacy disclosures.

Detected Service	Vendor	Category	Resource Type	Privacy Disclosure Guidance

Runtime, WordPress Plugin & JS Library Advisories (Live OSV.dev Match)

Ecosystem	Package / Identifier	Version	Status	Advisory & Remediation

External Script Inventory & Subresource Integrity (SRI) Status

Origin	SRI	crossorigin	Script URL

Manual Internal Version & Dependency CVE Lookup (Free · OSV.dev)

1. Auto-Tailored Security Config Generator Across 8 Server & CDN Stacks

Run a URL audit above to generate ready-to-deploy configs tailored to your detected CDN, script origins, and MX records

To guarantee zero UI or analytics breakage, CSP snippets default to Content-Security-Policy-Report-Only pre-populated with your page's existing origins. Remove -Report-Only once verified in staging/production.

2. One-Click SHA-384 Subresource Integrity (SRI) Generator

Fetches up to 6 third-party CDN JS/CSS URLs and computes ready-to-paste integrity="sha384-..." tags

3. Interactive SPF / DMARC / TLS-RPT & security.txt Wizard

Select your mail provider and enforcement policy to generate exact DNS TXT records and RFC 9116 security.txt

Email / MX Provider

DMARC Enforcement Policy

DMARC Aggregate Report (rua) & Security Contact Email (Optional)

4. On-Demand Executive Risk Summary & Engineering Handoff Brief

Translates raw technical findings into an executive summary, ready-to-send DevOps/agency Slack or email message, and phased rollout plan.

5. Stateless Live Security Posture SVG Badge (For GitHub README & Docs)

100% stateless SVG rendering with zero public database storage. Run an audit to copy your live Markdown badge.

Audit HTTP Security Headers, CSP Bypasses, TLS Generations, CMS/JS Leaks & Email DNS from Any URL

Enter any URL above and click "Run Audit"

7-Layer Security Breakdown

Priority Remediation Simulator (Toggle fixes to project score)

Critical Subpages Batch Audit (Login · Contact · Checkout · Privacy)

50-Point Security Checklist (Click any row for live evidence & fix)

HSTS Preload Eligibility (hstspreload.org 4-Requirement Check)

Content-Security-Policy (CSP) Directives & Bypass Gadget Analysis

Raw HTTP Response Headers Line-by-Line Audit

Set-Cookie Attributes & Host- / Secure- Prefix Audit

TLS Protocol Generation & HTTP/2 · HTTP/3 Matrix (SSL Labs Baseline)

Email Spoofing Defense (SPF / DMARC / DKIM / MTA-STS), DNSSEC & Dangling CNAME Audit

Runtime, CMS, JS Bundle Secrets & Sensitive File Exposure Summary

Third-Party Origin & Privacy Tracker Inventory Ledger

Runtime, WordPress Plugin & JS Library Advisories (Live OSV.dev Match)

External Script Inventory & Subresource Integrity (SRI) Status

Manual Internal Version & Dependency CVE Lookup (Free · OSV.dev)

1. Auto-Tailored Security Config Generator Across 8 Server & CDN Stacks

2. One-Click SHA-384 Subresource Integrity (SRI) Generator

3. Interactive SPF / DMARC / TLS-RPT & security.txt Wizard

4. On-Demand Executive Risk Summary & Engineering Handoff Brief

5. Stateless Live Security Posture SVG Badge (For GitHub README & Docs)

Multi-Domain & Subdomain Side-by-Side Comparison (Up to 5 URLs · Private)

Private Browser Audit History (Stored Locally · Never Published)

Audit HTTP Security Headers, CSP Bypasses, TLS Generations, CMS/JS Leaks & Email DNS from Any URL

Enter any URL above and click "Run Audit"

7-Layer Security Breakdown

Priority Remediation Simulator (Toggle fixes to project score)

Critical Subpages Batch Audit (Login · Contact · Checkout · Privacy)

50-Point Security Checklist (Click any row for live evidence & fix)

HSTS Preload Eligibility (hstspreload.org 4-Requirement Check)

Content-Security-Policy (CSP) Directives & Bypass Gadget Analysis

Raw HTTP Response Headers Line-by-Line Audit

Set-Cookie Attributes & __Host- / __Secure- Prefix Audit

TLS Protocol Generation & HTTP/2 · HTTP/3 Matrix (SSL Labs Baseline)

Email Spoofing Defense (SPF / DMARC / DKIM / MTA-STS), DNSSEC & Dangling CNAME Audit

Runtime, CMS, JS Bundle Secrets & Sensitive File Exposure Summary

Third-Party Origin & Privacy Tracker Inventory Ledger

Runtime, WordPress Plugin & JS Library Advisories (Live OSV.dev Match)

External Script Inventory & Subresource Integrity (SRI) Status

Manual Internal Version & Dependency CVE Lookup (Free · OSV.dev)

1. Auto-Tailored Security Config Generator Across 8 Server & CDN Stacks

2. One-Click SHA-384 Subresource Integrity (SRI) Generator

3. Interactive SPF / DMARC / TLS-RPT & security.txt Wizard

4. On-Demand Executive Risk Summary & Engineering Handoff Brief

5. Stateless Live Security Posture SVG Badge (For GitHub README & Docs)

Multi-Domain & Subdomain Side-by-Side Comparison (Up to 5 URLs · Private)

Private Browser Audit History (Stored Locally · Never Published)

Set-Cookie Attributes & Host- / Secure- Prefix Audit