Security, privacy & accessibility 7 tools
Headers, certificates, cookies set before consent, email authentication and WCAG issues, explained in plain words. Start with the security headers checker; the other tools go deeper on what it finds.
Runs the security headers checker. Every other tool on this page opens with the same address filled in.
In the full report
These tools are the Security and Accessibility modules, split out.
The full report checks headers, the certificate, cookies and WCAG issues together, scores each module and explains every fix in plain words.
Rings show a sample report, not your site.
Run a free report- Security headers checkerHSTS, CSP, cookie flagsA grade and 14 header checks
- SSL checkerCertificate, chain and protocols8 HTTPS checks, each with a fix
- Accessibility checkerWCAG issues by severityWCAG issues with the elements
- DMARC checker (email & DNS)SPF, DKIM, MX, DNSSEC, MTA-STS, BIMI14 checks with the record to fix
- Tech stack & CMS detectorNewCMS, plugins, known CVEsCMS, plugins, versions, advisories
- Mobile-friendly test + CSP generatorNew5 screen sizes, CSP from real loads5 screenshots plus a CSP to copy
Fix what the tools find
All 49 Security guides →- Security11 min read
Access-Control-Allow-Origin: what CORS allows and when * is dangerous
Access-Control-Allow-Origin tells browsers which other sites may read a response. What CORS is, when the * wildcard is fine, when it leaks data, and how to write a safe allowlist.Updated 4 Oct 2026 - Security20 min read
HTTP security headers: what each one does and the set that earns an A
HTTP security headers are instructions your server sends with every page that switch off risky browser defaults. This guide explains each one in plain terms, gives the set that earns an A, and shows how to add them on any server.Updated 4 Oct 2026 - Security16 min read
Rate limiting and bots on a small site, without blocking Google
Most traffic on a small site is bots: crawlers, scrapers, login guessers. Layer robots.txt, a CDN, server rate limits and WordPress switches so they stop costing CPU and Google never notices.Updated 4 Oct 2026
Questions about security, privacy & accessibility tools
Do these tools try to break into my site?
No. They read what any visitor’s browser receives: the response headers, the certificate, the cookies and the rendered page. Nothing logs in, submits a form or tests for attacks.
Which security tool should I start with?
The security headers checker. It grades the headers against the rules of the MDN HTTP Observatory and says which line to add for each one. Then check the certificate with the SSL checker and your email domain with the DMARC checker.
Does the cookie scanner make my site GDPR compliant?
It shows which cookies are set before a visitor consents, which is what regulators look at first. Whether your setup is lawful also depends on your consent texts and your purposes, so treat the scan as evidence for that review, not legal advice.
Can an automated check find every accessibility problem?
No. It finds the problems a machine can read, like missing alt text, unlabelled fields and low contrast, which is roughly a third to half of them. Test with a keyboard and a screen reader as well.
Want all of them at once?
The full report runs the speed, SEO, security, accessibility, schema and social checks together.