01
Security headers
CSP, HSTS, clickjacking, Referrer-Policy and the other visible HTTP headers.
Check headersFree · What the outside sees
Three checks. Not an audit.
Headers, certificate, mail. Paste an address; we show what a browser or an MTA already sees. An ugly score is often one header missing on the reverse proxy — not the end of the world.
02
SSL certificate and HSTS
Certificate validity, expiry, name, TLS protocol, and the HSTS header.
Check SSL / HSTS03
SMTP check
MX, ports 587 / 465 / 25, banner, STARTTLS. No password, no message sent.
Check SMTPWhat this is for
We use it in scoping, before anyone opens a ticket or says “pentest”. Twenty seconds. Either HSTS is there or it is not.
This is not a vulnerability scan. We do not hit /admin, we do not brute-force, we refuse localhost and private IPs. SMTP stops at the banner and STARTTLS.
How we reach the target
The request leaves our servers, like a plain HTTP or TLS client. A few redirects, hostname re-checked on each hop, dropped if it resolves inside a private range.
The result is not archived. The first run is free. To run again, a work email — not Gmail. If you want a person to look at conversion and mobile, that is the free website review. Stuck IT is the paid assessment.
What people ask
Will Google index these pages?
- Yes. They are public, in the sitemap, with a French original. /api/tools/* is not meant to be indexed.
Do you keep the URL I test?
- No. The result is shown and that is it. The target lives for the length of the request.
Why an email after the first check?
- One pass is often enough. To run again — any of the three tools — we ask for a work email, not Gmail or personal Outlook. No account. We use the address if a proper assessment would help.
Is this a security audit?
- No. It reports what is visible. An audit looks at code, accounts, network, backups. Different job.
The three tools
A human pass on a brochure site (conversion, mobile) is the free review. A stuck system is the fixed-price assessment.