Open-redirect detector
We fetch the URL you give us, extract every internal link, find the ones with redirect-shaped query parameters (?next=, ?return=, ?redirect=, …) and probe each one with an attacker-controlled value. Fails are endpoints that honored the destination without checking.
Keep hardening your site
This is one check of many. Run the rest — every tool is free, no account.
Security headers scan
Grade your live response headers
TLS certificate scan
Grade chain, expiry, and key strength
Security headers builder
Emit a ready-to-paste header block
CSP analyzer
Grade your Content-Security-Policy
Cookie security audit
Check Secure, HttpOnly, SameSite
Mixed-content scanner
Find http:// assets on https pages
HSTS preload checker
Grade against Chrome's preload list
CORS policy analyzer
Catch wildcard + credentials bugs