🛡️ Multi-Vector Security Header & Posture Auditor
Audit live URLs or inspect headers against OWASP Top 10 and web security standards.
⚡ 1-Click Remediation Snippets
Ready-to-deploy configs to fix all detected missing headers instantly.
Loading remediation config...🔐 TLS & Certificate Deep Inspector
Inspect TLS 1.3 protocol handshake, cryptographic cipher suites, certificate validity, expiration, and Subject Alternative Names (SANs).
🤝 TLS Handshake & Cipher Suite
Subject (Certificate Owner)
| Common Name (CN) | -- |
| Organization (O) | -- |
| Country (C) | -- |
| Serial Number | -- |
Issuer (Certificate Authority)
| Common Name (CN) | -- |
| Organization (O) | -- |
| Country (C) | -- |
| OCSP Must-Staple | -- |
🌐 Subject Alternative Names (SANs) (0)
🛡️ TLS Hardening Recommendations
⚖️ Side-by-Side Security Posture Comparison
Compare security headers, cookie flags, and vulnerability posture between two live targets or before-and-after hardening.
🔍 Findings Differential Breakdown
🟢 Resolved / Better in Target B (0)
🔴 New Issues / Regressions in Target B (0)
⚪ Unchanged Status (0)
📊 Security Vector Matrix Comparison
| Security Vector | Target A Posture | Target B Posture | Delta |
|---|---|---|---|
| Run a comparison to view the matrix. | |||
⚡ 1-Click Local Project Security Patcher
Automatically inspect your local repository, detect deployment platform (Netlify, Vercel, Next.js, Nginx, Static HTML), and inject hardened security headers with preview diff.
Unified Code Diff (--)
🛡️ Hardened Security Vectors Included
🔒 CSP Level 3 Policy Builder & Framework Exporter
Construct rock-solid Content Security Policies with 'strict-dynamic' and cryptographic nonces.
Loading CSP...🚀 Multi-Platform Deployment Snippets
Select a framework tab to view deployment config.🧬 Subresource Integrity (SRI) Hasher & HTML Injector
Calculate SHA-256, SHA-384, and SHA-512 hashes and automatically inject integrity attributes into HTML.
Single Asset Hasher
<script src="..." integrity="..." crossorigin="anonymous"></script>HTML Batch Tag Injector
Injected HTML will appear here...🎨 WCAG 2.2 Color Contrast & Accessibility Engine
Real-time relative luminance calculation, AA/AAA compliance validation, and color vision deficiency simulation.
Large Heading Text (24px)
This is normal body text (15px) demonstrating contrast legibility in your selected color scheme.
👁️ Color Vision Deficiency Simulation
🤖 AI Agent & Model Context Protocol (MCP) Hub
Connect Claude Desktop, Cursor AI, Cline, and Zed directly to Web Security Guard tools.
Web Security Guard features a native MCP server exposing automated header audits, CSP generation, SRI calculations, and WCAG validations to any MCP-compliant LLM agent.
Loading MCP configuration...🛠️ Exposed Agent Tools (9 Tools)
| Tool Name | Description | Required Parameters |
|---|---|---|
sec_audit_site |
Performs multi-vector security header & cookie audit. | url (string) |
sec_inspect_ssl |
Inspects TLS protocol version, cipher suites, SANs, and cert expiration. | domain (string), port (int, optional) |
sec_diff_postures |
Computes delta scorecard and side-by-side header comparison between targets. | target_a (string), target_b (string) |
sec_patch_project |
Auto-patches local repo (Netlify, Vercel, Next.js, Nginx, HTML) with hardened headers. | project_dir (string), platform (string), dry_run (bool) |
sec_generate_csp |
Generates Level 3 CSP policy & framework configs. | preset, nonce (optional) |
sec_generate_sri |
Computes SHA-256/384/512 hashes and HTML tags. | target or content |
sec_inject_sri |
Injects integrity and crossorigin attributes into HTML tags. | html_path_or_content (string) |
sec_check_contrast |
Evaluates WCAG 2.2 contrast ratio & color blindness. | fg_color, bg_color (hex strings) |
sec_generate_remediation |
Exports hardened server configs for Next.js, Nginx, Vercel, Netlify. | target (string), server_type (string) |
⚡ Multi-Platform Hardening Exporter
Download complete, hardened drop-in configuration files for your entire production stack.
Next.js 14/15 App Router
Edge middleware with crypto nonce generation & CSP Level 3 injection.
Vercel Edge Headers
Complete vercel.json security headers configuration.
Netlify Production
Drop-in _headers and netlify.toml headers block.
Nginx Virtual Host
Hardened TLS 1.3 ciphers, rate limiting & security-headers.conf.
Select a card above to inspect configuration code.📖 Web Security Defense-in-Depth Best Practices
Architectural principles for modern, zero-trust web application security.
1. CSP Level 3 & Strict Nonces
Avoid domain allowlists which are vulnerable to JSONP/CDN script bypasses. Rely on dynamic per-request cryptographic nonces with 'strict-dynamic'.
2. Complete Origin Isolation
Deploy COOP (same-origin), COEP (require-corp), and CORP (same-origin) to shield against Spectre side-channel attacks and unauthorized embedding.
3. Cookie Hardening (RFC 6265bis)
Enforce Secure; HttpOnly; SameSite=Lax (or Strict) on all session tokens. Use __Host- prefixes for highest origin binding.
4. Subresource Integrity (SRI)
Lock third-party CDN scripts and styles with cryptographic hashes (sha384-...) to prevent supply-chain compromises.
🔌 CLI Commands & Python SDK
Automate audits, SSL inspections, posture diffs, and project patches in your CI/CD pipelines.
CLI Quickstart
# 1. Audit any live site from terminal
web-sec-guard audit https://example.com --format json
# 2. Inspect TLS / SSL certificate & cipher suites
web-sec-guard ssl google.com --port 443
# 3. Compare security postures between two targets
web-sec-guard diff https://example.com https://google.com
# 4. 1-Click patch local project repository
web-sec-guard patch ./my-project --platform auto
# 5. Generate strict CSP policy
web-sec-guard csp --preset strict_nonce --export nextjs
# 6. Compute SRI hash for CDN script
web-sec-guard sri https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js
# 7. Launch Web Security Studio UI
web-sec-guard serve --port 8080 --openPython SDK Integration
from web_security_guard import SecurityAuditEngine, CSPBuilderEngine, WCAGContrastEngine
# Run comprehensive security audit
audit = SecurityAuditEngine.fetch_and_audit("https://example.com")
print(f"Score: {audit['score']}/100 Grade: {audit['grade']}")
# Generate Level 3 CSP
csp = CSPBuilderEngine.generate({"preset": "strict_nonce"})
print(csp["csp"])
# Validate WCAG 2.2 color contrast
contrast = WCAGContrastEngine.evaluate("#1a73e8", "#ffffff")
print(f"Contrast Ratio: {contrast['ratio_formatted']}, AA Normal: {contrast['wcag_aa_normal']}")