SITE UNDER CONSTRUCTION. Everything here is provided AS IS, WITHOUT WARRANTIES, to the extent the law allows. It is information, not professional advice. Use at your own risk. Terms and liability limits →

eThorns ES
Menu
Buy us a coffeeEspañoleThorns 2026 · Made in Colombia
← Security & privacyES

Tool 1.5

Website security scan (headers, TLS, HTTPS)

Passive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.

Online checkThe domain goes to our server (api.ethorns.com), which checks it and keeps only the result for 1 hour.

An automated check; it doesn't guarantee security.

How to use it

  1. Type a domain or URL, for example example.com.
  2. Press Scan. Our server (api.ethorns.com) requests your homepage the way a browser would; it can take up to 30 seconds, and the result is kept for an hour.
  3. Read the grade and fix each red row with the suggested change.

What the scan asks your site for

Run it when a new site goes live or after moving to another host or site builder. It reads what your homepage sends to every visitor and tells you which basic protections are on.

It makes three kinds of requests, all of them things a browser does: the http:// homepage, to see whether it sends visitors on to https://; the https:// homepage, following redirects within the site; and the file /.well-known/security.txt. From those it runs 13 checks on HTTPS, the certificate, security headers, cookies and version numbers.

A C grade, and what to fix first

Scanning tienda-ejemplo.co shows green on the HTTPS redirect, HTTPS, the certificate, the TLS version, X-Content-Type-Options, Referrer-Policy, cookie flags and version leaks, and red on HSTS, Content-Security-Policy, clickjacking protection, Permissions-Policy and security.txt. Eight of 13 checks pass, about 62%, so the grade is C. The cut-offs are 90% for A, 75% for B, 60% for C and 40% for D; below that it's F.

Each red row shows the fix. Start with HSTS and clickjacking protection: one header each, such as Strict-Transport-Security: max-age=31536000; includeSubDomains, added in your server settings or hosting panel. Leave Content-Security-Policy for last, because a strict policy can block your own analytics, chat widget or payment button; try it on a copy of the site first.

Why an A isn't a guarantee

Only the homepage is checked. Your checkout, login or admin pages can send different headers. The scan doesn't look for outdated plugins, weak passwords, open ports or malware, and apart from version numbers in headers it can't tell whether your software is up to date. An A means the basics are in place, not that the site can't be hacked.

If HTTPS doesn't work at all, the scan stops there and gives no grade. The certificate check fails when it expires in 14 days or less. A firewall that blocks automated visits may show us a challenge page instead of your homepage, and then the result describes that page.

FAQ

What does the scan do to the site?

It's a passive check: it makes the same requests a visitor's browser makes, namely the homepage over http and https and the public security.txt file. It doesn't scan ports, test passwords or try any attack.

What grade is good?

A or B means the basics are in place. C or lower usually means missing security headers. Most are one line each in the server or hosting settings; Content-Security-Policy takes more work.

What does HSTS do, and why does the scan want 180 days?

HSTS (the `Strict-Transport-Security` header) tells a browser that has visited your site once to use only HTTPS for it from then on, so someone on the same public Wi-Fi can't quietly switch a visitor to plain `http://`. The check passes only when `max-age` is at least `15552000` seconds (180 days); a shorter value counts as missing.

I fixed the headers. Why is the grade the same?

Results are kept for up to an hour per domain, so a new scan within that hour shows the old answer. If it's still the same later, check that the change reached the homepage itself: a CDN or cache in front of your site, or a second server, may still be sending the old headers.

What is security.txt?

A small text file at `/.well-known/security.txt` (defined in RFC 9116) that tells people who find a security problem on your site how to report it. It needs at least a `Contact:` line with an email address or a web form. The check passes when the file exists and includes that line.

Guides for this tool

  • 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
  • 1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
  • 1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
  • 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
  • 1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
  • 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
  • 1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
  • 1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
  • 1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
  • 1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
  • 1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
  • 1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
  • 1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌