Catch the security basics before they bite
PinMarks reads your home page response on a schedule and checks HTTPS, the standard security headers, cookie flags and exposed server details. Each finding arrives with the fix and an owner.
Free for 15 days. No credit card needed.
No Content-Security-Policy header
HTTP does not redirect to HTTPS
Cookies without security flags
Security3 open issues
Set up once. Undone by one deploy.
Security headers and cookie flags live in server and CDN settings that few people look at. A migration or a new proxy can drop them and nothing looks broken.
A change removes a header
Moving host, adding a CDN or changing a proxy can silently remove headers that were set before.
It sits between teams
Developers, ops and marketing tools all touch the response. Nobody is sure whose job the headers are.
Visitors never see it
A missing header does not break the page, so it can stay missing for years until someone audits it.
From scan to secured
The basics,
checked every scan
Each scan reads the response from your home page once and checks it against the standard set of protections.
- HTTPS is available, and http:// redirects to https://
- Strict-Transport-Security, Content-Security-Policy and clickjacking protection
- X-Content-Type-Options, Referrer-Policy and Permissions-Policy
- Cookies set with Secure, HttpOnly and SameSite
- Server software and version exposed in headers
Home page checks
HTTPSHTTP redirects to HTTPS
0/1 checkHeadersSecurity headers present
4/7 headersCookiesCookies with all three flags
1/3 cookiesServerNo version exposed
1/1 checkEvery finding
has a fix
Open a finding to see what is missing, why it matters and the header or setting to add, with a link to the reference.
- What is missing or weak
- Why it matters for visitors
- The setting to change
- Rescan to confirm
No Content-Security-Policy header
First detected 5d ago · Last scanned today
Problem
A Content-Security-Policy limits which scripts and resources can run, which reduces the impact of cross-site scripting.
Found on
- /
Recommended fix
Send a Content-Security-Policy header that lists the sources you trust.
Read-only,
never a probe
PinMarks only looks at the response headers on your own address. It does not send attack traffic and it does not try to exploit anything, so it is safe to run on production.
What a scan does
ReadsResponse headers of the home page
1/1 requestReadshttp:// redirect behaviour
1/1 requestNeverProbes, payloads or exploit attempts
0/0How is this different from…
What about a penetration test?
Good at: A deep, expert look for real weaknesses.
Falls short: It is a point in time, costs a lot and does not run again after the next deploy.
PinMarks: A light, repeating check of the basics between your tests.
What about an online header checker?
Good at: A quick one-off grade of a single URL.
Falls short: You have to remember to run it, and nothing tracks changes or assigns an owner.
PinMarks: Runs on a schedule, keeps the history and sends findings to your tracker.
What about trusting the hosting setup?
Good at: Often a decent default.
Falls short: A migration or a new proxy can drop settings without anyone noticing.
PinMarks: Notices the week a protection disappears.
Security fixes sit between developers and ops. Give each one an owner.
Report issue copies a finding into your Feedback inbox with its priority, first affected page and screenshot. Whoever owns the server or CDN can make the change.
Cookies without security flags
First detected 2d ago · Last scanned today
Problem
Some cookies are missing Secure, HttpOnly or SameSite, so they are easier to read or misuse.
Found on
- /
Recommended fix
Set Secure, HttpOnly and SameSite on cookies that page scripts do not need to read.
You set the rules
You choose what is checked
- UX, conversion and security checks are off until you turn them on under What should we check?
- Checks the home page of the site you monitor
- Daily, weekly or monthly, or scan on demand
- Skipped when you rescan a single page
You decide what counts
- Dismiss a finding that is intentional
- Rescan to confirm a fix
- Nothing goes to your tracker until you press Report issue
- Export the findings as a Word document, a PDF or a CSV
Website monitoring is on the Enterprise plan. Try it free for 15 days:
Start free trialA trail of tighter security
A header added today can vanish next quarter. Scan history shows whether it stays.
A score you can chart
Every scan keeps its score and its open issues, so improvement is easy to show.
Regressions stand out
A protection that disappears after a release shows up as a new finding in the Scans view.
Reports for clients
Export the findings as a Word document, a PDF or a CSV spreadsheet.
Built for one site or a whole portfolio
- Check client sites after every migration
- A separate score and history for each site
- Hand each finding to the person who owns the server
- Know when a deploy drops a header
- Keep a record between security reviews
- Share one list with developers and ops
The rest of your site's health, in the same monitor
Accessibility, content, SEO, links, legal gaps, uptime and an archive of your proof all live in one place.
Accessibility
Checks every page against WCAG 2.1 or 2.2 at level A, AA or AAA, with an accessibility score and plain-English fix steps.
Learn moreContent quality
AI-assisted review of spelling, grammar and wording, plus brand consistency checks and your own custom checks.
Learn moreSEO & AEO
SEO and AI-search checks on every page, with Google PageSpeed, Core Web Vitals and a starting llms.txt.
Learn moreBroken links
Tests internal and external links, so dead ends are found before your visitors hit them.
Learn moreLegal & privacy
Finds legal and privacy gaps that are easy to miss. Assign each one, send it to your tracker or export a client report.
Learn moreUptime monitoring
Checks as often as every minute and emails you when a site goes down or recovers. Warns 14 days before an SSL certificate expires.
Learn moreUX & conversion
AI-assisted review of weak calls to action, vague headlines, missing social proof and pricing-page gaps, plus layout, form and mobile problems seen in screenshots. Turn it on when you want it.
Learn moreCRO analysis
Conversion findings on every scan, plus an AI review of any one page with a score, fixes ranked by impact, quick wins and A/B test ideas. Every issue joins your checks.
Learn moreSecurity
Checks your home page for HTTPS, security headers, cookie flags and exposed server details. Turn it on when you want it.
Learn moreCompliance vault
Proof that you found it and fixed it. Every full scan is archived for up to two years, with a log of what was fixed, by whom and when, and a downloadable evidence package with a signed certificate.
Learn moreFAQ
Frequently asked questions
Everything you need to know before you start collecting feedback.
Whether your site is served over HTTPS and http:// redirects to it, the Strict-Transport-Security, Content-Security-Policy, clickjacking, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers, cookie flags, and server software or version details exposed in headers.
No. It reads the response headers from your own home page and never sends attack traffic or tries to exploit anything, so it is safe to run on production.
The home page of the site you monitor. The check is skipped when you rescan a single page.
No. It is a light, repeating check of the basics. A penetration test is still the way to find deeper weaknesses, and this keeps the basics in place between tests.
No. UX, conversion and security checks are off until you turn them on under What should we check? in the monitor settings. See the rest of the monitor on the Website Monitoring page.
Website monitoring is on the Enterprise plan, and every plan starts with a 15-day free trial with no credit card needed. See pricing.
Stop chasing bugs.
Start pinning them.
Start collecting visual feedback today — fix bugs faster and keep your whole team in the loop.
15-day free trial · No credit card · Cancel anytime