Terms
Last change: 14 November 2026
Short version: this is a free tool, it reports what a server said, and it is not a security guarantee.
What you get
The audit is free and needs no account. It fetches one address you name, reports the response headers and the meta tags it found, and grades the headers against a published checklist. Use it as often as you like, by hand.
What it is not
The grade describes a set of response headers at the moment of the request. It is not an audit of your application, not a penetration test, and not a statement that a site is safe to visit or to buy from. Nothing here is advice you should follow without understanding your own setup.
What not to do
- Do not point the endpoint at addresses you have no permission to inspect, at scale.
- Do not automate it as a substitute for a scanner you own: it opens one request per call and is meant for a person reading the result.
- Do not use it to probe networks, to test credential stuffing defences, or to hide other traffic behind this domain.
- Do not present a grade from this tool as a certification.
Requests that look like a bulk scan are refused or rate limited, and the private address gate exists for the same reason.
Availability
The service runs on free infrastructure and may change, pause or disappear without notice. There is no uptime promise and no support agreement. The configuration snippets are a starting point for your own review, not a deploy button.
Liability
The tool is provided as is, without warranty of any kind. To the extent the law allows, Pikkola is not liable for damage or loss arising from use of this site or from reliance on its output.
Changes
These terms may be updated with the site. The date at the top of this page is the date of the last change.