HTTPS and transport
HTTPS availability, HTTP→HTTPS redirect, HSTS strength.
Free · Ownership-verified · Non-intrusive
Find the security gaps in your website before anyone else does.
Prove the domain is yours, and in under a minute we check HTTPS, security headers, cookies, exposed files, outdated libraries and email protection, then hand you a report that explains every problem and exactly how to fix it.
2Prove you own
We only check domains whose owner asks us to. Publish this token in one of two ways, then press “Check verification”.
Option A · DNS record
Add a TXT record at your DNS provider. It can take a few minutes to appear.
- Type
- TXT
- Name
- Value
- the token above
Option B · File on your site
Upload a text file containing the token to this address:
Checking… this takes up to a minute.
Report for
Findings
Passed
An automated, non-intrusive surface check: it finds common misconfigurations, not every vulnerability. It is not a substitute for a full penetration test of your application.
Three steps
- Enter your domainThe site you want checked: example.com or shop.example.com.
- Prove it is yoursA DNS record or a small file. This keeps the service from being used against other people’s sites.
- Get your reportA score, every problem ranked by severity, and a ready-to-use fix for each, to download and share with your team.
What we check
Security headers
Content-Security-Policy quality, clickjacking protection, nosniff, Referrer- and Permissions-Policy.
Cookies and CORS
Secure, HttpOnly and SameSite flags; CORS that trusts any origin.
Exposed files
Public .git and .env, database dumps, backups, server-status, phpinfo, .DS_Store.
Page content
Mixed content, forms over HTTP, outdated JavaScript libraries with known flaws, missing integrity checks, leaked versions.
Email and DNS
SPF, DMARC, CAA, DNSSEC and security.txt: the defences against email spoofing and rogue certificates.
Our rules
Only your own domains
No check runs until the domain shows a token only we can issue for it.
Non-intrusive
Ordinary page requests and public DNS lookups. No attacks, no payloads, no login attempts, nothing that changes or slows your site.
Nothing stored
The report is built in your browser and never kept on our servers.
Free
No account, no card. Need a deeper review or help fixing? Quasova SI can do it.
Questions
Is this a penetration test?
No. It is a fast automated check of the configuration problems that cause most real incidents. A penetration test also probes your application’s logic and needs a written agreement; Quasova SI offers that separately.
Why do I have to prove ownership?
So nobody can use the service to look for weaknesses in a site that is not theirs.
Can I remove the token afterwards?
Yes. It is only needed at the moment of the check. Keep it if you want to re-check later.
Do you keep my results?
No. The results go straight to your browser; download the report if you want to keep it.