🔒
HTTPS & TLS certificate
Is HTTPS enforced, is your certificate valid and not about to expire, and is old, breakable encryption switched off?
IndieShield runs the checks attackers run first — TLS, security headers, exposed files and email spoofing — then hands you a graded report with plain-English fixes. Point it at your site and know where the open doors are in about 15 seconds.
All the testing happens on our server — the same requests a browser or curl makes — so results reflect what the whole internet sees, not just your machine.
Type your domain and confirm you own it. No account, no install, no agent to add to your site.
Our backend reads your headers, reads your TLS certificate over a real handshake, checks your DNS, and probes for accidentally-public files.
A graded report ranks every issue by severity — with a one-click prompt you can paste into Claude, Cursor or Copilot to fix them.
Four categories, dozens of checks — each one a real weakness a black-hat scans for automatically.
Is HTTPS enforced, is your certificate valid and not about to expire, and is old, breakable encryption switched off?
The headers that stop cross-site scripting, clickjacking and cookie theft — and a live test for dangerous CORS.
Secrets and source that shouldn't be downloadable — verified by content, not just a status code, so no false alarms.
Can someone send email that looks like it's from you? We check the DNS records that stop domain spoofing.
Real attackers rarely break the lock — they find the one you left off. Here's what they look for, and what IndieShield tells you to close.
The attack: a bot requests /.env and downloads your database password and API keys in one go.
The fix: block dotfiles at your server and rotate any exposed secret. IndieShield flags it as critical the moment it's reachable.
The attack: a single injected script steals your users' logged-in sessions (XSS) — the most common web attack there is.
The fix: add a CSP so the browser refuses untrusted scripts. We show you a safe starting policy.
The attack: on café Wi-Fi, an attacker quietly downgrades a visitor to plain HTTP and reads everything (SSL stripping).
The fix: force HTTPS and send an HSTS header so browsers refuse to fall back. One line of config.
The attack: anyone can send emails that appear to come from your domain — phishing your customers in your name.
The fix: publish SPF, DKIM and a DMARC policy. We check all three and tell you exactly what's missing.
IndieShield only does what a browser already does: it reads what your site serves publicly. It never injects attack payloads, never brute-forces logins, and never changes anything. That keeps it legal and safe to run on your own sites — and it still finds the same open doors a real attacker would.
The full scanner is free for your own projects. Monitoring and team features are on the way.
For your own projects.
For makers with a live product.
For freelancers & studios.
Prices are indicative while Pro is in development — the scanner itself is free to use today.
All scanning happens on our backend (a serverless function on Cloudflare's edge), not in your browser. It fetches your public pages and reads their headers, opens a real TLS handshake to read your certificate, queries public DNS over HTTPS, and requests a handful of well-known filenames. Then it scores everything and sends back a report.
No. Every request is one a normal browser already makes — read-only. It never submits attack payloads, never brute-forces anything, and never writes to your site. It's passive reconnaissance, nothing more.
On sites you own or are authorised to test, yes — because it only reads publicly served resources. Active penetration testing (trying to break in) is a different thing and needs written permission; IndieShield deliberately doesn't do that.
Nothing for normal use. It's built on Cloudflare's free tier, which covers roughly 100,000 scans a day, uses free public DNS resolvers, and needs no paid third-party APIs. You'd only pay at serious scale (about $5/month) or if you add your own custom domain.
No. Each scan is computed fresh and returned to your browser, then discarded. There's no account and no database of your results.
After a scan, one click generates a ready-to-paste prompt listing your issues and their fixes, written for an AI coding assistant like Claude, Cursor or Copilot. Paste it in and it'll walk your code and config and fix each item.
Only with their permission. The checks are non-intrusive, but you should always be authorised to test a domain before you scan it.
One scan. About 15 seconds. Plain-English fixes you can act on today.
Scan your site free →