security smoke test
Is your site secure enough?
A quick public-facing security smoke test. Paste a URL. Get a grade in <10 seconds.
What nzscan checks
-
TLS / SSL
Certificate validity, expiry, TLS version, cipher strength.
-
HTTP Headers
CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy.
-
Exposed Files
.env,.git,backup.zip,phpinfo.php, and friends. -
Cookies
Secure, HttpOnly, SameSite flags on every Set-Cookie.
-
Redirects & Mixed Content
HTTPS-only chain, no
http://references inside HTTPS pages.
What nzscan does not do
-
No exploitation
No port scanning, no exploitation, no login brute-forcing.
-
No third-party lookups
No reputation feeds or paid APIs — everything is computed from the site itself.
-
Permission required
Only scan sites you own or have explicit permission to test.
nzscan is a free tool from nzaisecurity.com — practical cyber security and AI guidance for New Zealand educators and students.