SSRF-aware fetching
Public DNS and IP ranges are validated before requests and again at every redirect.
Loading TraceLatticePreparing the requested view
TraceLattice turns public web, DNS, TLS, cookie, and resource signals into an explainable security posture report.
TraceLattice collects safe public signals, applies transparent scoring, and shows the evidence behind each result without running payloads, logging in, submitting forms, or making compliance claims.
Standard scan is the fast default. It fetches the requested public page and up to two same-origin HTML pages, then checks headers, cookies, trackers, third-party domains, DNS email-auth records, DNSSEC delegation, MTA-STS, TLS-RPT, CAA, TLS certificate health, security.txt, public discovery files, mixed content, SRI coverage, reverse-tabnabbing, third-party form actions, and client-side hygiene signals.
Many modern sites start with a small HTML shell, then JavaScript fills in scripts, images, forms, ads, analytics, and trackers after the page loads. Enhanced scan helps in that case: TraceLattice validates the same public URL, asks Cloudflare Browser Rendering to load the page once in a hosted browser, and parses the rendered HTML returned by Cloudflare with the same local rules. It does not use visitor cookies, log in, click, submit forms, bypass consent, or store page bodies.
Technical note: Cloudflare Browser Rendering is the hosted browser service; rendered HTML means the page after JavaScript has had a chance to change it. Configure CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN to enable it. Without those keys, Standard scan still works.
Public DNS and IP ranges are validated before requests and again at every redirect.
Time, redirects, response bytes, pages, resources, and hosted-browser waits are capped.
Reports come from typed local rules and visible weights, with no opaque scoring model.
Standard scan needs no paid API. Enhanced scan is optional and only runs when Cloudflare credentials are configured.