Your files stay on your device

Website security audit

Grade pasted response headers plus DNS and email-auth records fetched over DoH with a published weighted score, severity-ordered findings, evidence, and per-server fixes.

Paste a response header block, name the domain, and press Run security audit
The headers grade in this tab. The DNS, DMARC, and DNSSEC evidence comes back from the resolver you picked, and the published 1.0 methodology turns it all into one score.

This audit is honest about what a paste cannot show. There is no TLS handshake, so the Transport and TLS category never scores, and there is no page fetch, so third-party content never scores either. Those categories drop out and the remaining weights renormalize; the report says which did. Nothing behind authentication is checked, and no injection or access-control flaw can be found this way.
Options

More web & auth tools

- HTTP header parser (/web/headers)
- Cookie analyzer (/web/cookie)
- Live DNS lookup (/network/dns)
- CSP evaluator & builder (/web/csp)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/website-security-audit
Markdown version: https://nutter.tools/web/website-security-audit.md
Plain-text version: https://nutter.tools/web/website-security-audit.txt
Agent index: https://nutter.tools/llms.txt