SecurityHeaders.com
Deploy-VerifyGrades HTTP security headers.
Header findings verify against this grade.
Open official site ↗External site
INDEPENDENT MEASUREMENT TOOLS
Independent measurement tools
WebTrustEngine does not issue self-declared live scores. For security headers, TLS, performance, accessibility, structured data, search visibility and social previews, it connects findings and verification steps to results produced by independent tools.
The links below point to the official websites of the respective tools. Listing a tool does not imply affiliation, partnership or endorsement.
Limit
These are independent third-party tools. WebTrustEngine does not claim ownership of their results; it positions them within the verification and evidence workflow.
Security headers
MDN HTTP Observatory
Deploy-VerifyScores header and security configuration.
A second independent header opinion.
Open official site ↗External site
Google CSP Evaluator
Deploy-VerifyEvaluates CSP policy strength.
Final check of the CSP recipe.
Open official site ↗External site
OWASP Secure Headers Project
ReferenceReference source for header standards.
The standard the recipes rest on.
Open official site ↗External site
TLS / HTTPS
Qualys SSL Labs
Deploy-VerifyIssues the certificate and protocol grade.
TLS readiness pairs with this grade.
Open official site ↗External site
Hardenize
Deploy-VerifySummarises a domain's network/TLS posture.
A wide-angle second view.
Open official site ↗External site
internet.nl
Deploy-VerifyTests compliance with modern internet standards.
Extra verification incl. IPv6/DNSSEC.
Open official site ↗External site
Mozilla SSL Configuration Generator
Action recipeGenerates server TLS configuration templates.
Source for external action recipes.
Open official site ↗External site
Performance and page experience
Google PageSpeed Insights
Deploy-VerifyField and lab performance grade.
Performance readiness verifies here.
Open official site ↗External site
Lighthouse
Deploy-VerifyMeasures page quality in the lab.
Repeatable local measurement.
Open official site ↗External site
WebPageTest
Deploy-VerifyFilmstrip and metrics in real browsers.
Deep performance diagnosis.
Open official site ↗External site
GTmetrix
Deploy-VerifyProvides performance reports and monitoring.
An alternative measurement view.
Open official site ↗External site
Search Console Core Web Vitals
Deploy-VerifyReal-user experience report.
Long-term field-data tracking.
Open official site ↗External site
Technical SEO and crawling
Google Search Console
Deploy-VerifyIndexing and URL inspection.
Live index state reads here.
Open official site ↗External site
Bing Webmaster Tools
Deploy-VerifyCrawl and index on the Bing side.
The second search-engine view.
Open official site ↗External site
Screaming Frog SEO Spider
ReviewSite crawler; builds the technical inventory.
Independent crawl comparison.
Open official site ↗External site
Sitebulb
ReviewCrawler with visual audit reports.
An alternative technical audit.
Open official site ↗External site
Ahrefs Webmaster Tools
ReviewSite health and link profile.
External link context.
Open official site ↗External site
Semrush Site Audit
ReviewTechnical issue scanning.
A third-party health view.
Open official site ↗External site
W3C Markup Validator
Deploy-VerifyTests HTML validity.
Markup cleanliness verification.
Open official site ↗External site
W3C Link Checker
Deploy-VerifyScans for broken links.
Live link verification.
Open official site ↗External site
Structured data
Google Rich Results Test
Deploy-VerifyTests rich-result eligibility.
Google's view of the schema layer.
Open official site ↗External site
Schema.org Validator
Deploy-VerifyValidates schema syntax.
Syntax-level validation.
Open official site ↗External site
Social preview
Open Graph Protocol
ReferenceThe source of the OG tag standard.
Reference for the preview layer.
Open official site ↗External site
LinkedIn Post Inspector
Deploy-VerifyRefreshes and shows the LinkedIn preview.
Corporate share verification.
Open official site ↗External site
Facebook Sharing Debugger
Deploy-VerifyTests the Facebook preview cache.
Surfaces OG errors.
Open official site ↗External site
X (Twitter) Cards
ReferenceCard markup docs; the validator is now limited.
Reference for card tags.
Open official site ↗External site
Accessibility
WAVE
Deploy-VerifyOn-page accessibility flags.
Visual accessibility scan.
Open official site ↗External site
axe DevTools
Deploy-VerifyAutomated a11y testing in the browser.
Cross-test of engine findings.
Open official site ↗External site
Pa11y
ReviewAccessibility scanning from the CLI.
A second, automatable tool.
Open official site ↗External site
WebAIM Contrast Checker
Deploy-VerifyComputes colour contrast ratios.
Verification of contrast findings.
Open official site ↗External site
WCAG 2.2 Quick Reference
ReferenceThe official list of accessibility criteria.
The standard behind the findings.
Open official site ↗External site
AI / GEO / AEO
llms.txt
ReferenceThe AI-readable site summary proposal.
The generated llms.txt follows this standard.
Open official site ↗External site
IndexNow
Action recipeInstantly notifies search engines of new URLs.
The post-deploy notification step.
Open official site ↗External site
Peec AI
ReviewTracks brand visibility in AI answers.
An AI-visibility measurement example.
Open official site ↗External site
Otterly.AI
ReviewAI search visibility and citation tracking.
An alternative AI monitoring tool.
Open official site ↗External site
Analytics and user experience
Microsoft Clarity
ReviewProvides heatmaps and session recordings.
Post-launch behaviour view.
Open official site ↗External site
Specialist security tools
Sucuri SiteCheck
Deploy-VerifyScans for known malware signals.
External reputation/blocklist view.
Open official site ↗External site
OWASP ZAP Baseline Scan
Authorised testPassive baseline security scan.
Extra depth in an authorised environment.
Open official site ↗External site
Quick answers
Why does it exist?
An honesty layer; not everything is automated.
Which items?
A11y/legal/brand/content accuracy.
Are they excluded?
No; routed to a reviewer.
How is rollback tested?
Copy one file back from the backup dir and open the site; a five-minute drill insures the real moment of need.
Why is a double CSP risky?
Server + file policies intersect and permissions narrow; pages break unexpectedly. The single-source rule exists for this.
The most frequent hreflang error?
One-way mapping: TR points to EN but EN never answers back. The reciprocity audit catches it at file level.