Security, privacy and trust: free website tools
23 free security, privacy and trust tools for SaaS teams answering security questionnaires and procurement reviews: PrivacyHeaderPulse, SecurityTxtAndBugBountyKit, CookieConsentPulse, GdprDpaRopaKit, SubprocessorRadar, B2BTrustCenterAudit, B2BStatusPageSlaAudit, StatusSLACreditKit, SubdomainShadowPulse, StaticFormSpamShieldKit, TermsChangeRadar, PaymentPageScriptAudit, ConsentModeCheck, OidcConfigAudit, FdicDigitalSignAudit, MortgageDisclosureAudit, HealthTrackerAudit, SecurityIntegratorNdaaAudit, ItadDataDestructionAudit, TrialRecruitmentPageAudit, CompoundedRxClaimsAudit, FintechBankDisclosureAudit, PrivateOfferingMarketingAudit. Each runs a live, read-only scan with the full result free; fix packs and monitoring are optional.
23 free, read-only checks for SaaS teams answering security questionnaires and procurement reviews. Run any of them on your own site; each shows a score, every check it ran and what to fix.
PrivacyHeaderPulse
A free, read-only check of the HTTP headers that protect your visitors: HSTS, Content-Security-Policy, framing, MIME sniffing, referrer and permissions policies, and cookie flags. One page request.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
SecurityTxtAndBugBountyKit
Enter your domain. We check /.well-known/security.txt against RFC 9116 (Contact, Expires, Canonical, Policy, Encryption, signature), your CAA DNS records and your certificate issuer, then generate a valid security.txt, CAA records and a vulnerability disclosure policy for SOC 2 and ISO 27001 readiness.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
CookieConsentPulse
A free, read-only check from one normal page load: which consent banner (CMP) you use, which tracking tags load directly in the page, which cookies are set before any interaction, and whether privacy and "Do Not Sell or Share" links are present.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
GdprDpaRopaKit
Enter your SaaS site. We list every third-party service your pages load (analytics, ads, chat, payments), detect your consent banner, find your privacy, DPA and subprocessor pages and check the privacy notice for the items procurement teams look for. You get a pre-filled Article 30 technical data-flow worksheet and a procurement readiness checklist.
Free scan · fix pack $9.99, monitor from $29/mo · try the demo
SubprocessorRadar
Enter a SaaS domain. We read its public subprocessor, trust, security and privacy pages, its DNS records and its home page scripts to map the cloud, AI, auth and billing, data, observability, support and messaging vendors it discloses or loads.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
B2BTrustCenterAudit
Enter a SaaS domain. We check for the pages enterprise buyers and security questionnaires ask for (security or trust center, privacy policy, DPA, subprocessor list, terms, status page, security.txt) and whether you publicly mention SOC 2, ISO 27001, HIPAA, GDPR, pen testing or SSO.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
B2BStatusPageSlaAudit
Enter your company domain. We look for a public status page (status.yourdomain, /status, Atlassian Statuspage, Instatus, Better Stack and others), read its machine-readable summary and incident feed, and check that your site links the status page, an SLA with uptime commitment, a security page and a way to subscribe to incident updates: the items security questionnaires ask for.
Free scan · fix pack $4.99, monitor from $19/mo · try the demo
StatusSLACreditKit
Paste a vendor's status page (Atlassian Statuspage, like githubstatus.com). We total the major and critical incidents for this month and last month, estimate downtime against your SLA, and draft the credit-claim email for you to review and send.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
SubdomainShadowPulse
A free, passive summary of the TLS certificates publicly logged for your domain in Certificate Transparency: how many hostnames, how many new in the last 30 days, certificates expiring soon, wildcard use and hostnames whose certificates lapsed. Full hostname lists are only for verified owners.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
StaticFormSpamShieldKit
Enter a page with a contact or lead form. We read each form's markup (never submit it) and check for a honeypot field, a CAPTCHA such as Cloudflare Turnstile, hCaptcha or reCAPTCHA, a CSRF token, an HTTPS action endpoint, the form backend in use, email field type and autocomplete, and exposed mailto: addresses that attract scrapers. The kit includes a hardened copy-paste form.
Free scan · fix pack $4.99, monitor from $19/mo · try the demo
TermsChangeRadar
Paste a vendor's terms of service, privacy policy or DPA URL. We take a snapshot, flag clauses that matter (auto-renewal, price changes, AI training on your data, arbitration, data sharing, liability caps, termination), and on a monitor plan re-check daily and show exactly which sentences were added or removed.
Free scan · fix pack $4.99, monitor from $19/mo · try the demo
PaymentPageScriptAudit
Enter your checkout or payment page. We list every script it loads (first-party, third-party and payment provider), check Subresource Integrity, unpinned versions, HTTPS and your Content-Security-Policy with reporting, the evidence requirements 6.4.3 and 11.6.1 ask for since March 2025. The pack has the inventory as a CSV with a justification column and the exact integrity hashes to paste.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
ConsentModeCheck
Enter a page of your site. We find your Google tags and read the page and your public Google Tag Manager container for the consent default: all four v2 signals (ad_storage, analytics_storage, ad_user_data, ad_personalization), denied before consent where required, set before tags load, plus your consent banner (CMP), wait_for_update and ads_data_redaction. Missing v2 signals mean Google drops remarketing and conversion modeling for EEA traffic.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
OidcConfigAudit
Enter your issuer URL (for example https://login.yourcompany.com or https://yourtenant.example-idp.com/oauth2/default). We read the public /.well-known/openid-configuration and the signing keys it points to, and check them against the OIDC Discovery spec and current OAuth security guidance: exact issuer match, HTTPS everywhere, PKCE with S256, no implicit or password grants, no "none" or shared-secret-only signing, 2048-bit-plus keys, no private key material and a second key ready for rotation.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
FdicDigitalSignAudit
Enter a bank home page, login page or account-opening page. We read the served page and report what we observe: whether the FDIC official digital sign text appears and how close to the top, whether "Member FDIC" appears, whether the page mentions non-deposit products and shows the matching disclaimers, and links to FDIC resources. Each observation cites the rule text it relates to.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
MortgageDisclosureAudit
Enter a lender, broker or loan-officer page. We read the served page and report what we observe: an NMLS unique identifier and NMLS Consumer Access link, an Equal Housing Lender or Opportunity statement or logo, whether an advertised interest rate is accompanied by an APR, and links to licensing and privacy pages, each with the rule it relates to.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
HealthTrackerAudit
Enter a healthcare page, such as a find-a-doctor, appointment, condition or portal-login page. We list the third-party tracking technologies the served page loads (ad pixels, analytics, session replay and chat), whether forms post to third parties, and whether a consent tool and privacy notice link are present. You get a tracker inventory to review against the HHS OCR guidance and your BAAs.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
SecurityIntegratorNdaaAudit
Enter an integrator, monitoring or fire alarm company page. We read the served page and report what we observe: an NDAA Section 889 compliance statement, any covered video-surveillance or telecom brand names on the page, UL 827 central-station listing, TMA Five Diamond, a license number, NFPA 72 and NICET wording for fire alarm work and organization structured data. Each observation cites the rule or standard it relates to.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
ItadDataDestructionAudit
Enter an ITAD, data-destruction or electronics-recycling page. We read the served page and report what we observe: R2 or e-Stewards certification, NAID AAA, NIST SP 800-88 and its Clear, Purge and Destroy methods, certificates of destruction with serial-number reporting, chain-of-custody wording, links to the certifiers' public directories, downstream and export policy and organization structured data. Each observation cites the standard or rule it relates to.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
TrialRecruitmentPageAudit
Enter a study or patient-recruitment landing page. We read the served page and report what we observe: an NCT identifier and a link to the ClinicalTrials.gov record, clear research framing, wording FDA's recruitment guidance discusses (safety or effectiveness claims, "new treatment" without "investigational", "free treatment", payment in headlines), advertising pixels and session replay on the page, and MedicalStudy structured data. Each observation cites the source it relates to.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
CompoundedRxClaimsAudit
Enter a telehealth, weight-loss, hormone or med-spa page. We read the served page and report what we observe: whether compounded drugs are marketed and paired with a "not FDA-approved" statement, wording that presents them as generic, identical or FDA-approved, brand-name drug trademarks on the page, prescription and eligibility wording, risk and side-effect information, a LegitScript seal, and medical-supervision and state-licensure statements. Each observation cites the source it relates to.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
FintechBankDisclosureAudit
Enter a fintech home, pricing, card or account page. We read the served page and report what we observe: whether it mentions FDIC insurance, says the company is not a bank, names the FDIC-insured partner bank, explains that insurance covers only the failure of the insured bank, pairs crypto or investment mentions with "not FDIC insured" language, and whether it uses the official FDIC sign wording meant for insured banks. Each observation cites the rule it relates to.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
PrivateOfferingMarketingAudit
Enter a syndication, fund or "invest with us" page. We read the served page and report what we observe: offering language on a public page, an accredited-investors-only statement, the Regulation D rule named (506(b) or 506(c)), an accredited-status verification statement, target or projected returns and whether risk and no-guarantee language sits on the same page, gross-only performance figures, a not-an-offer / PPM statement and Form CRS, IAPD or BrokerCheck links. Each observation cites the rule it relates to.
Free scan · fix pack $4.99, monitor from $9/mo · try the demo
Other tool groups
AI search and AI-agent readiness Technical SEO Email deliverability and domains Conversion, signup and pricing Competitive and sales intelligence Performance and design Agencies and local business sites Newsletters and podcasts
Frequently asked questions
Are these security, privacy and trust tools free?
Yes. Every scan and its full result are free. An optional fix pack (copy-paste fixes for the failing checks) and monitor plans that re-check on a schedule are paid.
Do the tools change anything on my site?
No. They are read-only: they request public pages, files and DNS records the way a browser or mail server would, and never submit forms or log in.
Which security, privacy and trust tool should I start with?
Start with PrivacyHeaderPulse; each result page links to related checks.