See it in action
The report your clients see, the exact fix, and your attack surface.
Client report, white-labelled with your logo
Most checkers stop at headers. SurfaceWatch grades headers, HTTPS, cookies, email spoofing and exposed subdomains on one scorecard, gives you the exact copy-paste fix for every issue, and turns it into a client-ready report.
Pro adds white-label PDF reports, score history and daily monitoring for up to 25 client sites.
SurfaceWatch grades six layers of your site's security — the full picture an attacker sees first.
Encrypted, and forced to stay that way.
CSP, clickjacking protection, referrer & permissions policy.
Session cookies missing Secure, HttpOnly or SameSite.
SPF and DMARC, so nobody can fake email from your domain.
Front-end libraries with known vulnerabilities.
Admin, dev and staging systems anyone can find in public certificate logs.
On the page you're checking, click the SurfaceWatch icon. It reads only what's already public — no intrusive scanning.
A score out of 100 and a grade, with every issue listed by severity — medium, low, and what already passed.
Each issue comes with a ready-to-paste fix for nginx, Apache, Netlify, Vercel, Express or your DNS.
The report your clients see, the exact fix, and your attack surface.
Security Headers and Mozilla Observatory are good, trusted tools. They check a slice; SurfaceWatch grades the whole surface. Here is where each one fits.
| Feature | Security Headers | Mozilla Observatory | SurfaceWatch |
|---|---|---|---|
| Security headers | ✓ | ✓ | ✓ |
| HTTPS & HSTS | partial | ✓ | ✓ |
| Cookie flags | – | ✓ | ✓ |
| SPF & DMARC email checks | – | – | ✓ |
| Outdated JavaScript libraries | – | – | ✓ |
| Exposed subdomains | – | – | ✓ |
| Checks pages you’re logged in to, or staging | – | – | ✓ |
| Copy-paste fixes per platform | some | recommendations | ✓ |
| Client reports and monitoring | – | – | Pro |
| Hosted scanner or API, no install | ✓ | ✓ | – |
Where they win: if you want a hosted scan with nothing to install, or an API for your CI pipeline, use Security Headers or Observatory. Many people run both alongside SurfaceWatch.
Read the details: vs Security Headers · vs Mozilla Observatory. Based on each tool’s public documentation, October 2026; tools change.
Check a site before you ship, and get the exact header/cookie config for your stack.
Audit a prospect's site in 10 seconds and show them exactly what to fix — a great foot in the door.
Watch 25 client sites with alerts, bulk-check them, and send branded PDF reports with your logo.
Start free — upgrade inside the extension when you need it. 7-day free trial on Pro.
$0
$7/mo · or $59/yr
Header checkers only read your HTTP response headers. SurfaceWatch grades your whole surface: headers plus HTTPS/HSTS, cookie flags, SPF/DMARC email spoofing, outdated JavaScript, and exposed subdomains — then gives one A–F grade and the exact fix for each.
No. The checks are passive — it only reads information already exposed to any visitor (headers, cookies set in your browser, public DNS and certificate logs). It never probes or attacks the site, so it's safe to run on sites you don't own.
It checks the page you open, plus domain-level signals (email DNS and subdomains) that cover the whole domain. It does not crawl every URL. For a thorough review, check your key pages individually - home, login, checkout - since page content like scripts, forms and libraries can differ from page to page.
Yes — unlimited one-click checks, the full grade and every copy-paste fix are free forever. Pro ($7/mo or $59/yr, 7-day free trial) adds monitoring for 25 sites, bulk checks, and branded client reports.
The header, HTTPS, cookie and DNS fixes are safe to paste. The one exception is Content-Security-Policy — ship it in report-only mode first and tune it to your site, because a strict CSP can break your own scripts. SurfaceWatch flags this for you.
More in the docs.
One click, an honest grade, and the exact fix. Free.
Add to Chrome, it's free