TLS & Certificates
Protocol strength (flags TLS 1.1 and older), certificate trust, hostname match and expiry.
External Attack-Surface Check
See your website the way an attacker does.
A fast, non-intrusive scan of your site's external security posture — TLS, security headers, cookies, exposed files and the PHP runtime (PHP2Shell) — returned as a clear grade with prioritized fixes. No agents. No login. Nothing touched.
Passive & read-only · Public hosts only · Results in seconds
URL format — https://yourcompany.com or http://yourcompany.com · the scheme you type is used; a bare domain defaults to https://
7Check categories
0 bytesStored after scan
A–FPosture grade
SecondsTime to results
Coverage
What every scan checks
Seven categories of external posture, scored and explained — each finding comes with a concrete fix.
Security Headers
Content-Security-Policy, HSTS, X-Content-Type-Options, clickjacking protection, Referrer-Policy.
Cookie Hygiene
Checks that session and auth cookies carry the Secure and HttpOnly flags.
Information Disclosure
Detects leaked server and framework versions that hand attackers a target list.
Exposed Files
Flags publicly reachable .git, .env, backups, phpinfo and more.
PHP2Shell (PHP runtime)
Checks the advertised PHP version against the CVE-2026-109618/109619 pre-auth RCE fixes — including EOL branches. Version-only: no exploitation attempt is made; for active validation contact Infopercept.
Posture Grade
A weighted A–F score that summarizes risk at a glance, with issues ranked by severity.
Process
How it works
Three steps, a few seconds, zero footprint on your infrastructure.
01
Submit your URL
Paste any public website address. No account, no install, no credentials.
02
We read what's public
The engine inspects only what your site already exposes to the internet — never exploitation, never intrusion.
03
Get a graded report
A clear posture grade with every finding ranked by severity and paired with a remediation step.
Built safe by design
A scanner that can't be turned into a weapon.
Most "URL checkers" can be abused to attack internal systems or third parties. This one is engineered so it can't — it's the same discipline Infopercept applies to every engagement.
-
Passive & non-intrusiveReads public responses only. No exploitation, no payloads, no brute force.
-
Public targets onlyThe scanner only ever talks to public web addresses — it can't be pointed at internal or private networks.
-
Nothing storedScans are stateless. We keep zero bytes of your results after the response is returned.
-
Rate-limited & boundedPer-client limits, strict timeouts and capped responses keep the service fair and abuse-resistant.
Ready to check your posture?
Get a grade and a fix list in seconds — free and non-intrusive.