prefixkit RU

DNS, SSL & email

HTTP security headers check

Grade a site's HTTP security headers: HTTPS and redirect, HSTS, Content-Security-Policy, clickjacking protection, cookies, version leaks. The redirect chain and all response headers.

Which headers matter

  • Strict-Transport-Security — forbids the browser to use HTTP for the site.
  • Content-Security-Policy — lists where scripts and styles may load from: the main XSS defence.
  • X-Frame-Options / frame-ancestors — stop other sites from framing yours.
  • X-Content-Type-Options, Referrer-Policy, Permissions-Policy — simple headers that close whole classes of attacks and leaks.

How to add them

nginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; and the same for the others. Apache: Header always set X-Content-Type-Options "nosniff". Cloudflare: Rules → Transform Rules → Modify Response Header.

Certificate and DNS

Certificate validity and chain are in the SSL check, domain records and CAA in the DNS lookup.

More tools: dns, ssl & email

DNS lookupAll records plus SPF, DKIM, DMARC and DNSSEC.DNS propagationIs a new record visible in 20 countries yet.WHOISRegistrar, dates and status of a domain or IP.SSL certificate check newExpiry, issuer, names, HTTPS redirect and HSTS.CSR generator newCSR and private key in the browser, RSA or ECDSA.SPF & DMARC generator newRecords for Google, Microsoft, Yandex and more.Blacklist checkAn IP or domain against 29 spam lists, plus PTR.Email header analyzer newDelivery path, delays, SPF, DKIM, DMARC, spam.DMARC report analyzer newWho sends as your domain; when to set p=reject.