Understand your website's configuration.
Start with free public DNS and certificate observations, or analyze a set of HTTP response headers entirely in your own browser. No accounts, vulnerability exploitation, port scans, site crawling, or private-system access.
Basic Website Checks
Public DNS and HTTPS certificate snapshots, plus an offline header-analysis lab.
- A, AAAA, MX, NS, TXT, CAA and DMARC signals
- Certificate issuer, expiration and observed TLS
- HTTP header analysis of text you paste locally
Verified DNS & Email Policy Report
Proposed owner-verified public DNS report with recorded evidence and prioritized, clearly qualified review suggestions.
- A, AAAA, MX, NS, TXT, CAA and DMARC record observations
- SPF and DMARC configuration heuristics, mail routing and certificate-issuance-policy indicators
- Downloadable text and browser-printable findings with limitations
DNS/email policy only: this paid report does not include live TLS certificate tests, HTTP-header fetching, vulnerability scans or compliance certifications. Those existing free checks are separate.
Not available for purchase yet. Checkout opens only after authorization, sandbox payment testing, reliable delivery and applicable rights are verified. Review the owner-verification and report preview workflow.
Ask about the reportWebsite Consultation
Planned introductory 30-minute configuration discussion and concise follow-up notes. Additional work quoted separately.
- Explain observed configuration findings
- Discuss fix priorities and risks
- Written next-step checklist
Free domain and HTTPS snapshot
Uses our existing public DNS and certificate APIs. Your hostname is sent to Cloudflare's DNS resolver and an independent TLS-check provider. Their limits apply. Both endpoints require explicit permission. No web pages are fetched from the target.
These are free, limited evidence summaries—not the enhanced $4.99 report. Files are generated in your browser without a report upload.
Free HTTP security-header lab
Analyze headers you already have, entirely on your device. Nothing you paste is uploaded by this lab. It never contacts the website being discussed. You may paste a sanitized list of header names and values, or try the built-in example.
Privacy: Never paste Cookie, Set-Cookie, Authorization, bearer tokens, session IDs, API keys, or customer information. The lab rejects headers commonly carrying credentials. Input is not saved.
Create your own security-header configuration
Try the original Savana Header Policy Studio: generate starter templates for Cloudflare Pages, Nginx or Apache entirely in your browser, with staging precautions and no website access or remote scanning.
Open free Header Policy StudioAdditional free, independent resources
These reference tools are operated by other organizations and may have their own privacy policies, rate limits, and restrictions. Links below do not automatically submit your domain, call their APIs, or imply that Savana Security may redistribute their results.
- Mozilla HTTP Observatory — independent website configuration checks; review its terms before use.
- Qualys SSL Labs — third-party TLS testing; we do not embed its API or resell its results.
- OWASP Secure Headers Project — educational guidance on security headers.
Links do not establish authorization. Use third-party tools only for systems you are permitted to test and in accordance with each provider's terms.
Know the limits before you buy
No check here proves a website is secure. A missing header is not necessarily an exploitable vulnerability; some protections require careful app-specific configuration. The free tools and proposed paid report are not penetration tests, compliance certifications, PCI-approved vulnerability scans, breach searches, comprehensive TLS audits, or guarantees against compromise.
More intrusive checks (including vulnerability scanning, authentication and injection testing) require verified ownership or explicit written authorization, an agreed scope and rules of engagement, and appropriate expertise, licensing and insurance review before offering the service.
Request help interpreting results