TraceLattice scanner

Inspect a public website's observable security posture.

Start with Standard scan for a fast public check. Use Enhanced scan when you want a fuller look at trackers, ads, forms, or scripts that appear only after the page finishes loading.

Lifetime scans--Successful Standard + Enhanced scans

New assessment

Scan a public website

Standard scan by default

Open a clearly labeled sample report

Public HTTP/S only3 HTML pages maxNo page body retentionEnhanced finds more loaded tools

HTTP response controlsTLS certificate healthDNS and email authenticationThird-party supply chainStatic client-side riskVulnerability disclosure

Assessment coverage

Each category contributes evidence to a bounded posture report, not a universal safety verdict.

Transport controlsHTTPS, CSP, HSTS, framing, MIME and browser policy headers

Cookie hygieneSecure, HttpOnly, SameSite, scope and persistence context

Trust surfaceThird-party domains, trackers, scripts, forms and mixed content

Posture modelEvidence-led components with transparent deductions and limitations

Bounded defensive analysis. TraceLattice samples up to three public same-origin pages plus visible DNS, TLS, header, cookie, and resource signals. It does not execute target JavaScript, authenticate, exploit, or determine legal compliance.

Scope, safeguards, and blind spots

Every target and redirect is DNS-validated. Private, reserved, local, credentialed, and non-standard-port destinations are blocked before fetching.

TraceLattice does not execute target JavaScript, authenticate, submit forms, test payloads, or observe consent-gated runtime activity.

Loading TraceLatticePreparing the requested view