external posture / passive checks

Check your website's public security posture before you ship.

Run a free passive website security scan of the public signals anyone can inspect. Get prioritized findings, redacted evidence, and practical fixes without credentials or an installed agent.

The scan summary and highest-priority evidence are free. The complete evidence-and-fix report is a one-time paid unlock.

Run a scan View example report

passive-by-defaultssrf-protectedscope-limitedno-agents

siteguardrail ~ /new

passive

No signupNo credentialsRead-only checksEvidence-backed

Focused checks

Start with the exact exposure you care about.

Each focused page explains the signal, shows how to interpret it, and runs the same passive scanner with the relevant result kept in the free preview.

Production bundles

Source map exposure checker

Check whether a deployed JavaScript bundle points to a reachable production source map.

Open checker ->Public JavaScript

JavaScript secrets scanner

Review deployed scripts for secret-looking credentials while separating intentionally public keys.

Open checker ->Public paths

Exposed files checker

Look for reachable environment files, repository metadata, backups, configuration, and debug output.

Open checker ->

Scan-report

Evidence, ranked by severity.

Every finding ships with the proof attackers would see and the patch your team can apply.

15issues found

Score: 45/100
Pages: 1
JS files: 1
Warnings: 1

Critical0

High0

Medium2

Low13

MediumMissing HSTS headerhigh confidence

Evidence: strict-transport-security header not present on the HTTPS response.
Risk: Browsers may continue to allow insecure HTTP connections if a user or link attempts HTTP.
Fix: Strict-Transport-Security: max-age=31536000; includeSubDomains

MediumMissing Content Security Policyhigh confidence

Evidence: No content-security-policy header present on the response.
Risk: Without CSP, injected scripts execute freely if any XSS exists on the page.
Fix: Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-...'

Read the full example report

Coverage

What attackers see, we check first.

Six surfaces. One pass. Zero credentials required.

Transport & headers

TLS, HSTS, CSP, browser policy, CORS, and redirect posture.

Exposed files

.env, .git, config files, source maps, backups, and debug paths.

Cookie hygiene

Secure, HttpOnly, SameSite, session naming, and domain scoping.

DNS posture

SPF, DMARC, CAA, DNSSEC, expiry, and typo-domain signals.

Public scripts

Third-party JavaScript, source maps, credential patterns, and GraphQL exposure.

Risky forms

HTTP forms, password GET submissions, autocomplete, and passive CSRF hints.

Guardrails

Useful coverage. Polite execution.

Built so engineering teams trust the results and the request log.

Passive by default

Findings come from observable public signals before any worker-based scanner is added.

SSRF-protected

Resolver and fetcher reject local, private, reserved, and metadata ranges.

Verified depth

Subdomain and GraphQL checks stay off until domain ownership can be verified.

Rate-aware

Per-request budgets, body caps, and timeouts keep checks polite.

Workflow

From URL to prioritized fixes.

Point at a URL

Start with a public site using passive, origin-limited checks.

Review public signals

SiteGuardrail checks externally visible policy, transport, content, and DNS posture.

Read the evidence

Each finding includes proof, affected target, risk, confidence, and exact remediation.

Ship the patch

Download the JSON report and turn it into engineering work.