Free tool · no sign-up
Type your site’s address. We load your public home page once, like any visitor, and grade HTTPS, the certificate, the security headers, cookie flags and mixed content, each with the fix for Vercel, Netlify, Cloudflare and Lovable. No account, and the result isn’t stored.
Example result · synthetic site, for illustration
Result · 10 Nov 2026
The page sends no Content-Security-Policy header or meta tag.
Fix: Send a Content-Security-Policy that lists where scripts may load from (start with default-src 'self').
PL-030 explained, with the fix for Vercel, Netlify, Cloudflare and Lovable
Cookie sb-demo-auth-token is set without HttpOnly.
Fix: Set cookies with Secure and SameSite=Lax; add HttpOnly to session cookies.
PL-033 explained, with the fix for Vercel, Netlify, Cloudflare and Lovable
X-Content-Type-Options is missing or isn't nosniff.
Fix: Send X-Content-Type-Options: nosniff
PL-032 explained, with the fix for Vercel, Netlify, Cloudflare and Lovable
HTTPS and certificate
Cookies set on a signed-out visit
| Cookie | Secure | HttpOnly | SameSite |
|---|---|---|---|
sb-demo-auth-token | yes | no | Lax |
Response headers
| Header | Value |
|---|---|
strict-transport-security PL-029 | max-age=63072000; includeSubDomains |
content-security-policy PL-030 | not sent |
content-security-policy-report-only | not sent |
x-frame-options PL-031 | DENY |
x-content-type-options PL-032 | not sent |
referrer-policy PL-036 | strict-origin-when-cross-origin |
permissions-policy | not sent |
server PL-035 | Vercel |
x-powered-by PL-035 | not sent |
A header check, not a security test. This reads one public page, the way any visitor’s browser does. It can’t see who can read your database, what your code does or whether your keys are exposed, and those cause the leaks that matter most in AI-built apps. The full check covers them, and never touches your database.
What it checks
Each finding links to a page that explains it, shows how to check it yourself and gives the fix for your host. The points are what each failed check costs in the grade.
| ID | What we flag | Severity | Points |
|---|---|---|---|
| PL-027 | The plain http:// address serves the page instead of redirecting to https://. | medium | 15 |
| PL-028 | The TLS certificate is invalid, expired, or expires within 21 days. | high medium | 30 / 15 |
| PL-029 | No Strict-Transport-Security header, or a max-age under 180 days. | low | 5 |
| PL-030 | No Content-Security-Policy (a report-only policy blocks nothing, so it doesn’t count). | medium | 15 |
| PL-031 | Any site can put the page in a frame: no frame-ancestors and no X-Frame-Options. | low | 5 |
| PL-032 | No X-Content-Type-Options: nosniff. | low | 5 |
| PL-033 | A cookie set without Secure, or a session cookie without HttpOnly. | medium | 15 |
| PL-034 | The page loads scripts or stylesheets over plain http://. | medium | 15 |
| PL-035 | Server or X-Powered-By headers that name software versions. | info | 0 |
| PL-036 | No Referrer-Policy header or meta tag. | info | 0 |
Start at 100. Each failed check costs its points once, however many cookies it caught. A is 90 or more, B 75, C 60, D 40, anything lower F. An invalid or expired certificate is always F, because browsers show a full-page warning.
.app and .devSome top-level domains, including .app and .dev, are on every browser’s HSTS preload list, so browsers never load them over plain HTTP. Sites on them pass PL-027 and PL-029 without a redirect or header of their own.
What it does, exactly
This is a passive check, like Mozilla Observatory or securityheaders.com. It reads what your site already sends to everyone.
What we send
http:// request to your home page, to see whether it redirects to HTTPShttps:// load of your home page, following at most 5 redirectsWhat we never do
For engineers
The same check is a public endpoint. It returns the grade, every finding with its fix, the checks that passed and the raw facts: redirects, certificate, headers and cookie flags (names only, never values).
https:// or http:// address; IP addresses and private names are refusedcurl -s https://api.patchlabs.dev/tools/headers-check \
-H 'Content-Type: application/json' \
-d '{"url": "https://your-app.com"}'{
"url": "https://your-app.com",
"final_url": "https://your-app.com/",
"grade": "C", "score": 65,
"counts": {"critical": 0, "high": 0, "medium": 2, "low": 1, "info": 0},
"findings": [
{"id": "PL-030", "severity": "medium",
"title": "No Content-Security-Policy",
"evidence": "The page sends no Content-Security-Policy header or meta tag.",
"fix": "Send a Content-Security-Policy that lists where scripts may load from (start with default-src 'self')."}
],
"passed": [{"id": "PL-027", "title": "HTTPS is forced"}],
"facts": {
"status": 200, "https_redirect": true,
"tls": {"version": "TLSv1.3", "issuer": "Let's Encrypt",
"expires": "2027-01-05", "days_left": 56},
"headers": {"strict-transport-security": "max-age=63072000", "content-security-policy": null},
"cookies": [{"name": "sb-auth-token", "secure": true, "httponly": false, "samesite": "Lax"}]
}
}Your site sends the right headers, which is worth having. It says nothing about your data: the most common leak in AI-built apps is a database rule that lets strangers read other people’s rows, and no header stops that. The full check rebuilds your database from its migrations and tests who can read what.
The result isn’t stored: it goes back to your browser. To enforce the hourly limit we keep the host name and a hashed network address. Cookie values are never read into the result, only their names and flags.
The tool makes the same requests any visitor makes to a public page, so yes, as with any header checker. Daily re-checks and alerts in the app only run on a domain your team proves it controls.
Each finding page covers that case. Two options work almost anywhere: put your custom domain behind Cloudflare and add the headers there, or set the policies that allow it (CSP and Referrer-Policy) with a meta tag in index.html. HSTS, framing and nosniff only work as real headers. See the security headers guide.
Browsers treat a cookie without SameSite as Lax, which already keeps it out of most requests other sites trigger. Setting it explicitly is still good practice, and the facts table shows it for every cookie.
Live posture
Add your app to PatchLabs, verify your domain with a file or a meta tag, and Live posture re-checks it daily, emails your team when the grade drops or a finding appears, and gives you a badge. PatchLabs never touches your database. Live posture only loads your public home page, like any visitor, and only on domains you verify.