Free tool · two requests · nothing stored
What does your server tell the browser?
Type your address and see every security header your site sends: what each one stops, and the exact line to add for each one missing.
Now read the code
Headers are what your server says about itself. They cannot show a key committed to your repo, a route anyone can call, or a payment webhook that believes whatever it is told. The ShipSaife scan reads the code and writes up each finding in plain English, with the exact fix.
Run a free scan
The grade and your worst finding are free. Every finding with its exact fix is $35, once.