CSP, HSTS, frame protection, MIME sniffing, referrer and permissions policies.
SSurface CheckPASSIVE WEB SECURITY
AUTHORIZED SCANS ONLY
OWNER TOOL / HTTP OBSERVATION
See what your
site exposes.
Check public headers, redirects, cookies, forms and mixed content without sending exploit payloads.
SCAN REPORT
Findings
WHAT IT CHECKS
Defensive by design.
HTTP redirects, mixed content, insecure forms, cookies and exposed server details.
Every finding includes a risk explanation and a practical fix for Cloudflare, Nginx or app code.