MSRX Security

Overview

A free website security scanner and toolkit. Paste a URL and MSRX Security runs a passive, read-only check of about 25 things an attacker looks at first: HTTPS and the HTTP-to-HTTPS redirect, HSTS, the TLS certificate, Content Security Policy and other security headers, cookie flags, mixed content, forms that submit over HTTP, JavaScript libraries with known vulnerabilities, version banners, security.txt, and the SPF, DMARC and CAA records that stop email spoofing and certificate mis-issue. It also recognises more than 30 products, from PHP, WordPress and Next.js to SharePoint, Citrix and Fortinet, matches published versions against the last 12 months of CVEs, including php2shell, and lists the vulnerabilities CISA has seen exploited in the past year for anything it cannot version. The result is a score out of 10 with a letter grade, a SWOT breakdown of strengths, weaknesses, opportunities and threats, a ranked list of what to fix first, and a plain-English explanation and copy-paste fix for every finding. Twenty-one more tools cover the rest: a dependency scanner that reads lockfiles from 12 package managers and flags vulnerable and actively exploited packages, a CVE lookup with CVSS, EPSS and CISA KEV data, a CVSS 4.0 calculator, a subdomain takeover check, a checker for GitHub Actions, Dockerfile and Kubernetes config, an email header analyser, an access-log attack finder, an IOC extractor, and tools for passwords, phishing links, JWTs, CSPs, hashes and leaked secrets. Most run entirely in your browser. No account, nothing stored, and the scanner refuses private and internal addresses. It is a health check of a public page, not a penetration test.

What it does

• Website scan scored out of 10, with a SWOT report and a fix-first list
• HTTPS, HSTS, TLS certificate, security headers, cookies and CORS
• Mixed content, HTTP forms and known-vulnerable JavaScript libraries
• SPF, DMARC and CAA checks for email spoofing and certificate mis-issue
• Recent CVEs matched to detected software, php2shell and React2Shell included
• A step-by-step how-to-use guide with screenshots
• Save a report as PDF or JSON, or share it as a link
• Password strength, generator and breached-password check (k-anonymity)
• Link inspector, JWT decoder, CSP evaluator, secret finder and hash tool
• Dependency scanner for npm, PyPI, Go, Cargo, RubyGems, Composer, Maven and NuGet lockfiles
• CVE lookup with CVSS, EPSS and exploited-in-the-wild status, plus a CVSS 4.0 calculator
• A page for every exploited CVE, by product, with an RSS feed
• Incident playbooks, an India CERT-In and 1930 guide, and scored security checklists
• Scam message checker for SMS, WhatsApp and call scripts, with an optional AI second opinion
• QR code checker and suspicious file checker, both fully in your browser
• Free API, command-line tool and MCP server for developers and AI assistants
• A “what happened?” page that routes you to the right incident playbook, a phishing e-mail checker and an optional weekly digest
• Weekly monitoring for sites you own, with change alerts and an optional score badge
• Subdomain takeover check from certificate logs
• GitHub Actions, Dockerfile and Kubernetes config checker
• Email header analyser, access-log attack finder and IOC extractor

Jump straight in