Cybersecurity · free, no signup
Web Server Config Analyzer
Paste an nginx or Apache configuration and see what it will actually serve. This is the config side of web posture — the Security Header & SSL Grader observes a live response, which is the symptom; this reads the file that decides it, which is what you can fix. Its centrepiece is a rule that silently deletes controls: in nginx a single add_header in a child block REPLACES the entire inherited set rather than merging with it, so adding one unrelated line inside a location wipes Strict-Transport-Security, Content-Security-Policy and the rest for every request that block handles. Nothing errors, the config test passes, and the headers are gone on that path only — which is why it survives a spot check of the home page. Also covers deprecated TLS versions, directory listing, version disclosure, proxy blocks that set no request headers, and Apache TraceEnable and AllowOverride All.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste an nginx or Apache configuration and see what it will actually serve. The trap it catches first: in nginx a single add_header inside a block replaces every header inherited from its parent rather than merging — so adding one unrelated line inside a location wipes HSTS, CSP and the rest for that path. Nothing errors, nginx -t passes, and the home page still looks correct.
include directives are not followed, so a file that pulls in others is only partly assessed. No host is contacted — for what your server actually sends, use the Security Header & SSL Grader against the live site.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The Web Application Penetration Testing engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore Web Application Penetration Testing