# Web security & TLS tools

Inspect transport, certificate and browser-policy evidence with clear limits.

Canonical: https://tamperbox.dev/categories/security

Updated: 2026-10-29

Reviewed: 2026-10-26

Inspect transport, certificate and browser-policy evidence with clear limits. A certificate handshake and a security-header grade test different properties; neither is a complete security audit. Supported paste modes analyze the supplied text locally.

## Choose a check

Start with the SSL Certificate Checker for expiry, hostname or chain errors. Compare TLSA records with DANE and inspect hybrid key exchange separately. Use Security Headers and Mixed Content checks for browser protections, and publish a current security.txt so researchers can find the reporting policy.

## Tools in this collection

- [DANE & TLSA Checker](https://tamperbox.dev/dane-checker): **Changed a server certificate? Check that its DNS fingerprint still matches.**

  Check that each server’s TLSA record matches the certificate it presents.
- [Security Headers Checker](https://tamperbox.dev/security-headers): **Find browser protections your website may be missing.**

  Grade a site's security headers from A+ to F, with the exact lines that fix them.
- [SSL Certificate Checker](https://tamperbox.dev/ssl-checker): **A certificate warning or renewal coming up? Check what your server presents.**

  Check a certificate chain: trust, names, expiry, key and the TLS version negotiated.
- [Post-Quantum TLS Checker](https://tamperbox.dev/post-quantum-checker): **See whether your site can negotiate a post-quantum key exchange.**

  Test ML-KEM key exchange from our server and review configuration guidance.
- [security.txt Checker](https://tamperbox.dev/security-txt-checker): **Help someone who finds a security issue reach the right contact.**

  Validate security.txt against RFC 9116 and get a corrected file to publish.
- [Mixed Content & Cookie Checker](https://tamperbox.dev/mixed-content-checker): **Moved to HTTPS? Look for insecure resources and cookie settings left behind.**

  Find http:// resources on an HTTPS page and cookies missing Secure, HttpOnly or SameSite.

## Continue exploring

[API & HTTP tools](https://tamperbox.dev/categories/api) · [Email authentication tools](https://tamperbox.dev/categories/email) · [Domains, registration & hosting tools](https://tamperbox.dev/categories/domains) · [DNS tools](https://tamperbox.dev/categories/dns) · [Network & IP tools](https://tamperbox.dev/categories/network) · [Crawl, SEO & site checks](https://tamperbox.dev/categories/web) · [Data format tools](https://tamperbox.dev/categories/data) · [Text & test data tools](https://tamperbox.dev/categories/text-testdata) · [Localization tools](https://tamperbox.dev/categories/localization) · [UI testing tools](https://tamperbox.dev/categories/ui-testing)