Security Tools

Website security is rarely one big setting. It is a handful of small, checkable pieces: a valid certificate, the right response headers, a sensible Content-Security-Policy and tokens that carry only what they should. This category groups the free checkers and generators that cover each of those pieces, so you can audit a site in a few minutes and know exactly what to fix. Everything runs in your browser or through a lightweight lookup, and nothing you enter is stored.

SSL certificate checker

Start with the certificate, because every other protection depends on HTTPS working. The SSL certificate checker shows who issued a certificate, the date it expires, how many days remain and every hostname it covers. Run it after a renewal, before a launch, or whenever visitors report a browser warning. An expired or mismatched certificate is the most common reason a site suddenly looks "not secure".

Security headers checker

Response headers tell the browser how strictly to treat your pages. The security headers checker scans any URL for Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and clickjacking protection, then grades each one as present, weak or missing. A header that exists but is too permissive, such as a short HSTS max-age, is flagged rather than counted as a pass.

CSP generator

A Content-Security-Policy is the strongest defence against cross-site scripting, and also the easiest header to get wrong. The CSP generator builds the policy directive by directive, starts from presets for Google Analytics, Google Fonts, YouTube and Stripe, warns about risky values like unsafe-inline, and gives you a snippet ready for Nginx, Apache, a meta tag or a _headers file. Test it in report-only mode first, then enforce it.

JWT decoder

Many APIs authenticate with JSON Web Tokens. The JWT decoder splits a token into its header, payload and signature, explains each registered claim and converts the expiry and issue times into real dates, all locally. It is the quickest way to see why an API answers 401, or to confirm that a token does not carry personal data it should not.

Who these checks are for

Developers use them before shipping a release, to confirm a new deployment did not drop a header or break the certificate chain. Site owners and marketers use them after moving hosts or adding a CDN, when security settings often change without anyone noticing. Agencies and freelancers use them to audit a client site in minutes and hand over a clear list of fixes. Search engines and browsers increasingly reward secure sites, so a few minutes here can protect both your visitors and your rankings.

A simple security routine

For a quick audit, check the certificate first, then the headers, then tighten the Content-Security-Policy, and finally review any tokens your application issues. Each page links to an in-depth guide that explains the results step by step, so you understand not only what is missing but why it matters and how to fix it.

Tip: put the certificate expiry date and a monthly header scan in your calendar. Many security problems on small sites start with something that quietly expired or was removed during an update. Keep a copy of the result so you can compare it after the next change.