Privacy-first website security

Know what your website exposes.

WebSentry performs a comprehensive, ephemeral security analysis. 13+ scan categories: headers, TLS, DNS, email security, cookies, CORS, exposed files, information leakage, SRI, JWT tokens, forms, SEO, accessibility, performance, and infrastructure.

No accountNo scan historyLive analysisEphemeral results
Security Headers
Deep CSP, HSTS, X-Frame-Options and 15+ header checks.
TLS / HTTPS
Certificate Transparency, HSTS preload, certificate details.
DNS & Email
A, AAAA, MX, NS, TXT, CAA + SPF/DMARC analysis.
Cookies
Secure, HttpOnly, SameSite attribute inspection.
CORS
Preflight testing, Allow-Origin/Credentials analysis.
Exposed Paths
35 sensitive paths: .git, .env, .DS_Store, debug endpoints.
Info Leakage
Source maps, debug endpoints, config files, version leaks.
JWT / Tokens
Detect exposed JWT tokens in HTML and cookies.
Performance
Page size, render-blocking resources, response time.
Accessibility
Alt text, form labels, heading hierarchy, ARIA landmarks.
Infrastructure
HTTP/2, HTTP/3, IPv6, DNSSEC detection.
SEO
Meta tags, Open Graph, canonical, heading structure.
Files
robots.txt, security.txt parsing and analysis.
Findings
150+ checks with evidence and recommendations.
How it works

A real scan, returned directly to your browser.

The browser sends the target to a Cloudflare Worker. The Worker validates the URL, resolves DNS via Cloudflare DoH, performs bounded HTTP requests, probes for exposed paths, checks CT logs, analyzes email security, tests CORS preflight, checks mixed content, analyzes forms, scans SEO/accessibility/performance/infrastructure, and streams each completed check back to the browser via SSE. No database. No persistence.

Privacy model

No login. No database. No stored reports.

WebSentry does not intentionally persist scan results or target history. Operational infrastructure can still have its own logs, so this site does not claim that network traffic is invisible everywhere.