What does your server give away?
Enter a domain. We read the headers it sends to every visitor and tell you what they reveal. Free, instant, nothing stored.
What this looks at
- Version banners
- Headers like X-Powered-By that announce your software and its version — the single most useful thing you can hand an attacker.
- Transport
- Whether the site answers over HTTPS and whether HSTS stops a first visit falling back to plain HTTP.
- Browser defences
- Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy — four headers most servers simply never send.
- Leaked errors
- PHP warnings printed into the page, which expose real file paths on the server.
What it cannot see
Everything here is read from the outside, from what your server volunteers to any visitor. It cannot see your PHP version if the server hides it, cannot read your file permissions, and cannot tell whether someone is already inside. Those need access, which is the difference between this page and the paid report.
A point-in-time look at public response headers. Not a penetration test and not a guarantee of security.