Web Server Audit
Enter a URL for a deeper look than a plain header dump: SysGlass follows the full redirect chain, grades the HTTP security headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) on an A–F scale, fingerprints the server and stack (nginx/Apache/Cloudflare, PHP/ASP.NET/Rails/WordPress, …), and flags cookies missing the Secure/HttpOnly/SameSite flags.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- The redirect chain and final URL + status code
- Security-header grade (A–F) across the six key headers
- HSTS — and whether the header meets the hstspreload.org criteria (max-age ≥ 1 year, includeSubDomains, preload)
- security.txt (RFC 9116) — whether a vulnerability-disclosure contact is published, with a valid Contact and a non-expired Expires date
- Server/stack fingerprint from headers and cookies
- Cookie security flags (Secure, HttpOnly, SameSite)
How to read the result
- A = all the key security headers present; F = none.
- Missing HSTS = browsers can be downgraded to http — add Strict-Transport-Security.
- Insecure cookies = session cookies without Secure/HttpOnly can be stolen.
- The stack fingerprint tells you what software is exposed (useful for patching).
Frequently asked questions
How is this different from the HTTP Header Checker?
The header checker shows the raw response and flags missing headers. The web scanner goes deeper: it grades the security posture A–F, follows the whole redirect chain, fingerprints the stack, and audits cookie security flags.
Which security headers matter most?
Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options: nosniff, X-Frame-Options, Referrer-Policy and Permissions-Policy. Add all six for an A.
What is HSTS preload?
Adding 'preload' to your HSTS header and submitting to hstspreload.org bakes HTTPS-only into browsers, so even the first request can't be downgraded. The scanner checks whether your header is preload-eligible — it needs max-age of at least one year plus the includeSubDomains and preload directives — and tells you exactly which directive is missing. It only judges the header; it can't see the actual preload list, so it reports eligibility, not membership.
What is security.txt and do I need one?
security.txt (RFC 9116) is a small text file at /.well-known/security.txt that publishes how to report a security problem — at minimum a Contact: address and an Expires: date. The scanner checks whether you serve one, whether it has a Contact field, and whether its Expires date is still in the future. It's optional but recommended: it gives researchers a clear, machine-readable way to reach you instead of guessing.
Why flag cookies?
Session cookies without Secure can leak over http; without HttpOnly they can be stolen by XSS. Set Secure, HttpOnly and SameSite on sensitive cookies.