ToolzyLab
Analyze one website or compare two with a clean, easy-to-read audit UI. Review security headers, redirects, SSL certificate details, caching, cookies, CORS, robots.txt, security.txt, raw headers, and export-ready reports in one focused workspace.
Paste a public URL, pick your scan mode, and get a way cleaner breakdown of what is good, what is missing, and what should be fixed next.
Everything important is grouped properly now, so users can understand the flow instantly.
Main target first. Second URL is optional for compare mode.
Choose how the request should run and how results should be filtered.
Main result summary for the current primary scan.
Important headers that are missing and should be added.
Headers found, but still not configured strongly enough.
Copy-ready examples and suggested fixes.
Searchable, filterable header table for the primary result.
| Header | Group | Value |
|---|
Side-by-side result comparison appears here when second URL is used.
Strong headers and positive checks already present.
Every redirect hop before the final response.
Certificate snapshot for HTTPS targets.
Presence checks for robots.txt and security.txt.
Cookies, caching, compression, CORS, and server exposure.
Plain text output for quick copying.
Recent scans saved in the browser.
HTTP headers describe response status, representation, caching, security policy, redirects, and server behavior, but a scan reflects one request from one environment. Enter a permitted URL, optional comparison target, method, timeout, header group, and search, then interpret redirects, CORS limits, cache layers, and missing headers in context.
HEAD and GET can be implemented differently. A CDN may return different values by location, protocol, device, authentication, or Accept headers. Record the final URL and status chain, and repeat important checks from browser developer tools or the controlled production environment.
Content-Type, Cache-Control, Content-Security-Policy, Strict-Transport-Security, Referrer-Policy, permissions, CORS, and cookies each have their own syntax and scope. A header can be present with an ineffective value. Evaluate directives against the site's architecture rather than treating a checklist badge as a security audit.
Browsers expose only permitted response information to scripts. A server, proxy, or CDN can also add, remove, merge, or normalize fields. Compare with curl, hosting controls, and application configuration when a header is unexpectedly unavailable, and never paste secrets into a public URL.
Capture the request conditions and verify important findings at the authoritative layer.
Technical references: MDN HTTP headers reference MDN HTTP messages guide
Servers and applications can implement HEAD separately, and intermediaries may cache it differently. Use the method that represents the real request you are debugging.
Browser CORS rules control which cross-origin responses and fields scripts may access. A missing visible value can be an observation limit rather than proof the server omitted it.
No. Directive values, coverage, nonces or hashes, report behavior, application code, and other controls determine effectiveness. Review the full policy.
Cache-Control is the main modern field, with validators such as ETag and Last-Modified supporting conditional requests. CDN behavior and application rules also matter.
A CDN location, cache hit, redirect, protocol, user agent, deployment, authentication state, or dynamic response can change them. Record conditions before comparing.
Do not place credentials in a URL. Browser restrictions and the tool's request model may not reproduce an authenticated client. Use approved local tooling for sensitive endpoints.