SniffPupFree security headers checker for your live site
Check your live site for missing security headers (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), weak cookie flags and a missing HTTPS redirect.
Free checkers
Free security checkers
Each checker runs SniffPup's normal free, passive scan of a live web URL and explains one part of the results in detail: what it checks, what it can't see, and how to check it yourself. Only scan sites you own or are authorized to test. SniffPup scans live web URLs only, not native mobile apps.
Is your .env public? Free .env exposure checker
Check whether anyone can download your .env, .env.local, .env.production, .git/config or .npmrc from your live site. Passive check that reports variable names only, never values.
Free Supabase service_role key leak checker
Check whether your live site ships a Supabase service_role or sb_secret_ key to the browser. Also shows whether your Supabase URL and public anon key are present, which is normal.
Want everything at once? Run the full free scan from the home page. It's the same scan.