Your files stay on your device

Website security regression checker

Drop two audit exports from different dates and see which controls improved, regressed, appeared, or changed severity, matched on stable ids.

The earlier audit you are comparing against . Or drop the JSON file here.
Baseline audit JSONChoose a .json file

The newer audit . Or drop the JSON file here.
Current audit JSONChoose a .json file

Nothing compared yet
Paste both audits (or drop the JSON files) and press Compare.The audit-export schema this tool reads

One JSON object per export: an optional site (used only for the different-sites warning), an optional generatedAt (display only), an optional schemaVersion (1.x; older exports without one upgrade in as version 1), and a required findings array. Each finding carries a required stable id plus optional category, title, severity (critical, high, medium, low, info), status (pass, warn, fail), and detail. Severities or statuses outside those words read as Unknown.

{ "site": "https://status.example.co.uk", "generatedAt": "2026-10-01", "schemaVersion": "1.0", "findings": [ { "id": "hsts-max-age", "category": "headers", "title": "HSTS one year", "severity": "critical", "status": "fail", "detail": "max-age is 30 days" } ] }

Copy

Findings match on their stable id, so keep ids identical across audit runs; the human-readable title may change freely. A finding that disappears from the current audit is reported absent, not fixed: nothing in its category completed, and treating silence as success is how a broken scanner reads as a clean site. A definite verdict that becomes Unknown is grouped with regressions, because an answer you had is an answer you lost. When the two exports name different sites the compare still runs but says so, since tracking one site over time is this tool's job and comparing two sites is a different one. The compare itself is plain JSON matching in this tab: no uploads, no logging, and no history beyond what you paste.
OptionsCompare

More web & auth tools

- CSP evaluator & builder (/web/csp)
- HTTP header parser (/web/headers)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/website-security-regression-checker
Markdown version: https://nutter.tools/web/website-security-regression-checker.md
Plain-text version: https://nutter.tools/web/website-security-regression-checker.txt
Agent index: https://nutter.tools/llms.txt