Free tools

Single-purpose, read-only checkers. Each runs part of the Defexity scan and shows you exactly those results, no account needed.

• Security headers checker

  Check a site’s HTTP security headers: HSTS, Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy and Permissions-Policy.

  Read

• Exposed .env, .git and backup files checker

  Check whether a site serves files that should never be public: .env, .git, backups, logs, private keys, source maps, directory listings and API docs.

  Read

• Is my API key exposed? Check your site’s JavaScript

  Scan a live site’s HTML and JavaScript for secret keys: Stripe, OpenAI, Anthropic, Gemini, Groq, AWS, Supabase service_role, GitHub, database URLs and more.

  Read

• HTTPS, SSL certificate and HSTS checker

  Check that a site uses HTTPS, redirects HTTP, has a valid certificate, sends HSTS, refuses old TLS versions and loads no insecure resources.

  Read

• SEO basics checker for AI-built sites

  Check robots.txt, sitemap.xml, title, meta description, canonical, social image, favicon, noindex, placeholder text and structured data on a live site.

  Read