Beacon runs a passive check of your site’s HTTP security posture — HTTPS, HSTS, Content-Security-Policy and the rest of the OWASP security headers, cookie flags and security.txt — then grades it A–F with the exact header found and how to fix each gap.
Beacon only reads your site’s HTTP response headers — it never probes, brute-forces or attacks. Every result shows the actual header value found (or “not set”), so the report is real and reproducible, never fabricated.
The audit follows the OWASP Secure Headers Project and Mozilla Observatory.
This is a fast posture check that catches the most common, high-impact misconfigurations. For deep penetration testing, pair it with a dedicated security tool — but most sites can lift their grade in an afternoon with these fixes.
Yes. It is a passive check that only reads HTTP response headers — no intrusive scanning, probing or attacks. It is rate-limited and respects standard guards.
A weighted score across HTTPS/HSTS, the OWASP security headers, cookie flags and security.txt, mapped to A–F — aligned with Mozilla Observatory and securityheaders.com.
Completely. Each check shows the exact header value found on your live site (or “not set”). Beacon never shows fabricated security results.
Free, passive, and real — with exact fixes.