I launched a new security checker: enter a single URL and it checks security headers (HSTS, CSP, and more), cookie settings, and whether HTTPS is enforced, then gives the site a grade. The concept is "a health checkup, not a penetration test" β it analyzes only the information the server already returns publicly, without any attack activity.
While preparing this tool, I re-examined the internal utility that safely fetches external URLs and found, and closed, a theoretically exploitable time-of-check to time-of-use (TOCTOU) gap. Nothing changes in how the tools behave; the process for validating external URLs is simply more robust. I also ran the finished tool on our own site and applied several additional security headers.
With eight tools, the navigation had also become cluttered, so I reorganized it. I grouped the tools into three purpose-based hubs β Site Check Center, Proposal & Quote Tools, and Business Utility Tools β and added an All-in-One Check that assesses SEO, security, and ad review readiness from a single URL.
I used these checks on nexalab.app itself while building them.