HTTPS and TLS
Checks HTTPS use and HTTP-to-HTTPS redirection, and presents available TLS certificate details such as issuer and validity.
Web Security Scanner by Wafyro Software
See your website’s security more clearly.
Run a preliminary check of a public website’s HTTPS setup, TLS certificate details, security headers, and cookie attributes. Review a score, risk level, and practical recommendations in one place.
Web appJSON report exportBrowser-local history
What WafyShield checks
Review several important signals from a website’s publicly available HTTP response.
Security headers
Reviews headers including HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Cookie attributes
Checks visible cookie attributes such as Secure, HttpOnly, and SameSite, which can help reduce common exposure risks.
Score and findings
Summarizes the scan with a security score, risk level, and PASS, WARNING, or FAIL findings for the checks performed.
Actionable recommendations
Highlights areas that may need attention and provides practical guidance for reviewing or improving the observed configuration.
History and JSON report
Keep a scan history in the browser’s local storage and download a JSON report for your own records.
How to use it
A straightforward workflow for an initial look at a public website’s security configuration.
STEP 01
Enter a public URL
Open WafyShield and submit the public website address you want to check.
STEP 02
Review the results
Read the score, risk level, and individual findings to understand which checks passed or need attention.
STEP 03
Follow up on findings
Use the recommendations to guide further investigation, then export the JSON report if you need a copy.
Useful across different roles
WafyShield can help with an initial configuration review, whether you manage a site yourself or support other teams.
Developers and website owners
Review common response-header and HTTPS settings while developing, deploying, or maintaining a website.
Small businesses
Get a readable first-pass view of selected web security settings without needing to interpret every header manually.
Security professionals
Use the results as a quick supplementary check alongside a broader, properly scoped security assessment.
Scan scope matters
WafyShield checks information it can observe from a public website’s HTTP/HTTPS responses. It is intended as a preliminary review, not an exhaustive security assessment.
- It does not replace penetration testing or a full security audit.
- A passing result does not guarantee that a website is secure.
- Findings should be interpreted in the context of the application and its threat model.
Understand the browser features
WafyShield includes convenience features to review and keep scan results available during later visits.
- Scan history is stored in the browser’s local storage.
- A JSON report can be downloaded for record keeping.
- Light and dark themes are available.
Frequently asked questions
Is WafyShield a full penetration testing tool?
No. It performs a preliminary check of selected HTTPS/TLS details, response security headers, and cookie attributes. It does not replace a full penetration test or comprehensive security audit.
Can I scan any website?
WafyShield is designed to scan publicly accessible HTTP or HTTPS websites. Private network addresses and localhost targets are blocked by the scanner.
What does the score mean?
The score summarizes the checks performed by WafyShield. Read it together with the individual findings and recommendations; it is not a guarantee of overall security.
Where is scan history stored?
Scan history is stored in your browser’s local storage. Treat your browser profile and exported reports appropriately if they contain information you consider sensitive.
Does a passing result mean my website is secure?
No. The scanner only checks selected signals visible to it. Application logic, authentication, authorization, dependencies, infrastructure, and other security concerns may require separate testing.
Take a closer look at your website’s configuration.
Use WafyShield for an initial review of HTTPS, security headers, and cookie settings—then investigate findings in the context of your own site.