Run an HTTP security probe on a live URL — reachability, redirect chain, and visible response details, plus a reference checklist for HSTS, X-Frame-Options, and CSP. Uses cloud-based processing.
Content reviewed October 2026 · About Toolzum
Check pasted response headers for XSS-relevant protections — Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and X-XSS-Protection presence, locally in your browser.
Check a host over HTTPS from your browser — SSL/TLS reachability (which proves the browser validated the certificate chain) plus public issuance history (issuer, expiry, cert count) via crt.sh. No cipher-suite or protocol-version scan: browsers do not expose handshakes.
Discover subdomains via public certificate records plus live DNS checks of common names. Read-only lookups run from your browser — the domain you check is visible to crt.sh and Google DNS, as with any lookup.
Grade videos with 18 filters across Color, Artistic, Blur, and Lighting (grayscale, sepia, pixelate, gaussian blur, vignette, brightness/contrast/saturation) plus a live still-frame preview. Export MP4, WebM, or GIF — local FFmpeg work, unlimited saves.
Grade photos with 6 one-click filter presets — Vintage, Noir, Vibrant, Cool Tone, Warm Glow — plus 6 manual sliders (brightness, contrast, saturation, blur, sepia, grayscale) rendered live through canvas filters at full source resolution. Exports JPEG at quality 0.95 as enhanced-<name>; nothing uploads.
CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
No grading — the tool reports reachability, final URL, and any visible status/content-type, with the header list as an ungraded reference. Verify headers server-side with curl -sI.
Browsers hide security headers cross-origin unless CORS-exposed — the probe runs in your browser, so header values must be checked server-side.
No account needed — checks run without sign-in or saved history.
Content Security Policy Generator
Build a Content Security Policy header by selecting directives and allowed sources. Code never leaves your device — formatting and validation run locally in your browser.
CSP Policy Validator
Validate Content Security Policy headers against W3C spec and common pitfalls. Code never leaves your device — formatting and validation run locally in your browser.