# GuardPad - Security Scanner — Headers, SSL, DNS & Monitoring > Headers, SSL, DNS & Monitoring (iPhone/iPad app by Olof Petterson.) - Source: https://appshunter.io/ios/app/guardpad-security-scanner/id6759147267 (this page in markdown: same URL + `.md`) - Developer: [Olof Petterson](https://appshunter.io/developer/1808256024) - Category: Developer Tools, Utilities - Price: Free with in-app purchases - Age rating: 4+ - Requires: iOS 26.2 · 8 MB - Languages: American English - Released: 2026-02-18 - Data updated: 2026-08-13 - User reviews in markdown: https://appshunter.io/ios/app/guardpad-security-scanner/id6759147267/reviews.md ## What is GuardPad? Scan any URL and get an instant A+ to F security grade with actionable fixes — right from your iPhone or iPad. GuardPad analyzes 11 HTTP security headers, SSL/TLS certificates (including post-quantum readiness), cookies, redirect chains, DNS records, email security, and infrastructure fingerprints in seconds. The most comprehensive mobile security scanner — and the only one with widgets, Siri integration, and a Share Extension. Try every feature free for 3 days. No account required. No data collected. NATIVE iOS, EVERYWHERE YOU NEED IT • Share Extension — scan any URL straight from Safari or any browser • Siri & Shortcuts — "Hey Siri, scan example.com with GuardPad" • Home Screen & Lock Screen widgets for pinned domains • Control Center toggle for instant re-scans (iOS 18+) • Universal app with optimized iPad layouts FREE FEATURES • 11 graded security headers (HSTS, CSP, COOP, COEP, CORP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Server) • Email security analysis — SPF, DMARC, DKIM, MTA-STS, and BIMI graded with detailed findings • Cookie security analysis (Secure, HttpOnly, SameSite, __Host- prefix) • CSP depth analysis (nonce, strict-dynamic, Report-Only) • SSL/TLS certificate inspection with cipher suite details • TLS depth analysis with post-quantum (X25519MLKEM768) detection • Redirect chain visualization with quality grading • Deprecated header detection (HPKP, Expect-CT, Feature-Policy) • OWASP Top 10:2025 compliance mapping • .well-known directory scanner (security.txt RFC 9116 and more) • WAF/CDN fingerprinting (Cloudflare, CloudFront, Akamai, Fastly, and 10 more) • Subdomain discovery via DNS-over-HTTPS • API endpoint intelligence (rate limits, exposed docs, GraphQL introspection) • PCI DSS 4.0 readiness assessment • Comparative context — percentile ranking against your scan history • Quick Fix mode — see your highest-impact issues first • Actionable WHAT/WHY/FIX diagnostics for every finding • Domain-grouped scan history • Works offline for reviewing past results PRO FEATURES • Continuous monitoring — scheduled background re-scans with change-only notifications (unlimited domains with Yearly, 1 domain with Lifetime) • Certificate expiry alerts (30/14/7/3/1 days) • Grade trend charts and security posture dashboard • Batch scanning — up to 50 URLs at once with aggregate report • Shareable security grade card and shields.io-style badge for READMEs • iPad side-by-side scan comparison • Server-specific fix code snippets for nginx, Apache, Express.js, and Caddy • CORS configuration tester • DNS record lookup with DNSSEC, CAA, and full record types (A, AAAA, MX, CNAME, TXT, NS, SOA) • PDF and Markdown export • Full certificate chain inspection Built for developers, security engineers, and IT teams who ship secure web applications. Whether you maintain nginx, Apache, Express.js, or Caddy, GuardPad gives you the tools to verify your configuration matches OWASP, PCI DSS 4.0, and modern security baselines. PRIVACY-FIRST No account. No analytics SDKs. No tracking. Zero external dependencies. All analysis happens on your device. Scan results stay in SwiftData on your device only. See Privacy Policy in Settings. GuardPad is a developer tool for auditing security configuration of web servers you own or have permission to scan. Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ ## Pricing and in-app purchases Base price: Free. **One-time purchases** | Purchase | Price | Type | | --- | --- | --- | | GuardPad PRO | $9.99 | one-time | ## Version history (last 5 releases) ### 2.0.1 — 2026-08-09 v2.0.1 — More trustworthy grades, better PRO experience. GRADING ACCURACY • SPF records with CIDR mechanisms (a/24, mx/24) and uncommon mechanisms are now graded correctly — no more false F on valid records. • Scanning www.yourdomain.com now finds SPF/DMARC published at your root domain (RFC 7489 organizational-domain fallback). • Long SPF records split across multiple TXT strings are parsed correctly. • When DNS lookups fail on restricted networks, email security is reported as unavailable instead of dragging down your grade. • CSP frame-ancestors with a wildcard no longer counts as clickjacking protection. PRO & TRIAL • GuardPad PRO Yearly now starts with a 14-day free trial. • Yearly subscribers see their plan and renewal date in Settings, with in-app subscription management. • Clear feedback for purchases, restores, and Ask to Buy — no more silent failures. • Trial reminder notification before your PRO trial ends. • New Lifetime purchases include background monitoring for 1 pinned domain; unlimited monitoring comes with Yearly. Existing Lifetime owners keep unlimited monitoring. RELIABILITY • On-device crash diagnostics (nothing leaves your device — privacy unchanged: no data collected). • If the local database ever has to be rebuilt, the app now tells you instead of silently losing history. ### 2.0 — 2026-06-24 v2.0 — The biggest GuardPad update ever. Native iOS integration, deeper security analysis, continuous monitoring, and advanced features for power users. NATIVE iOS INTEGRATION NEW: Share Extension — tap Share in Safari (or any browser), pick GuardPad, and scan instantly. NEW: Siri & Shortcuts — "Hey Siri, scan example.com with GuardPad" returns a grade. Build Shortcuts workflows for IT teams. NEW: Home Screen & Lock Screen widgets — small/medium grade widgets for pinned domains, plus a circular Lock Screen widget. NEW: Control Center toggle (iOS 18+) — re-scan your last domain in two taps. NEW: TipKit feature discovery — contextual tips help you find batch scanning, Quick Fix, share cards, and badges. DEEPER SECURITY ANALYSIS NEW: OWASP Top 10:2025 mapping — every finding mapped to the current category. NEW: MTA-STS and BIMI email security analysis alongside SPF/DMARC/DKIM. NEW: Post-quantum TLS detection (X25519MLKEM768) — see which servers are quantum-safe. NEW: TLS depth analysis — TLS 1.0/1.1 legacy warnings and ATS compatibility verdict. NEW: .well-known directory scanner — checks 5+ standard endpoints including security.txt. NEW: Reporting-Endpoints, Clear-Site-Data, and Speculation-Rules header detection. CONTINUOUS MONITORING (PRO) NEW: Background re-scans for pinned domains — only notify when the grade changes. NEW: Certificate expiry alerts — 30/14/7/3/1-day warnings before your cert expires. NEW: Grade trend charts powered by Swift Charts. NEW: Security posture dashboard — see your whole portfolio at a glance. ADVANCED ANALYSIS (PRO) NEW: WAF/CDN fingerprinting — detect Cloudflare, CloudFront, Akamai, Fastly, Sucuri, Imperva and 8 more from response headers. NEW: Subdomain discovery — DoH-based DNS enumeration against a curated wordlist. NEW: API endpoint intelligence — rate-limit headers, exposed Swagger/OpenAPI docs, GraphQL introspection detection, auth scheme. NEW: PCI DSS 4.0 readiness — 8 compliance checks mapped from your scan data. NEW: Comparative context — "Top 15% for header security" percentile ranking. EXPERIENCE NEW: WCAG-compliant contrast across all surfaces. NEW: Optimized iPad layouts and side-by-side compare on larger screens. NEW: Haptic feedback and micro-interactions throughout. NEW: Achievements track your security wins without being annoying. PRICING NEW: GuardPad PRO Yearly at $3.99/year — full PRO access with yearly renewal. GuardPad PRO Lifetime is now $9.99 — every feature forever, one-time purchase. 3-day free PRO trial on first launch. No account required. ### 1.3 — 2026-03-27 NEW: DNS-only fallback — when a web server is unreachable, GuardPad automatically runs DNS analysis and delivers a partial security grade. Works for mail-only domains, temporarily down sites, and non-HTTP services. NEW: DNS-only results show a distinct dashed-ring grade, "DNS ONLY" badge, email-focused report card, and adapted methodology breakdown (70% email / 10% DNSSEC / 10% CAA / 10% MX). NEW: MX record quality analysis — detects multiple mail servers, null MX (RFC 7505), bare IP addresses, and priority ordering. NEW: DNS-only integration across the app — history badges, batch auto-fallback with aggregate stats, cross-mode diff, share card, PDF/Markdown exports, and VoiceOver announcements. NEW: Context-sensitive grading — your grade now accounts for site type. A static blog isn't held to the same standard as a banking SPA. Five site types detected automatically: static, SPA, API, CMS, and generic. NEW: Grade explanations — tap any grade to see exactly which headers matter most for your site type and how weights were adjusted. NEW: Site type override — disagree with the detection? Override it and watch your grade recalculate live. NEW: Smart recommendations — fix suggestions ordered by relevance to your site type. NEW: Reporting API detection — Report-To and Network Error Logging (NEL) headers identified. NEW: Email security analysis — SPF, DMARC, and DKIM records graded individually. NEW: OWASP Top 10:2025 compliance mapping — each finding mapped to the risk it mitigates. NEW: DNSSEC validation and CAA record grading in DNS tools. NEW: Trusted Types CSP detection with A+ grade boost. IMPROVED: Re-scan diff overlay with inline grade change badges. IMPROVED: Shareable amber-themed grade card image. IMPROVED: 3-tab layout (Scan / History / Tools) with iPad sidebar. IMPROVED: Batch scan rows show site type badges. IMPROVED: PDF and Markdown exports include all analysis sections. ### 1.2 — 2026-03-21 NEW: Cookie security analysis — every cookie inspected for Secure, HttpOnly, SameSite, and __Host- prefix compliance. Cookie grade affects your overall score. NEW: Quick Fix mode — tap the lightning pill to see your highest-impact issues ranked by how much they affect your grade. Fix the top 3 and watch your score climb. NEW: CSP depth analysis — nonce and strict-dynamic detection, Report-Only mode flagging, and smarter unsafe-inline severity scoring. NEW: Cross-origin isolation headers — COOP, COEP, and CORP are now fully graded security headers, not just informational. 11 headers analyzed total. NEW: Deprecated header detection — HPKP, Expect-CT, and Feature-Policy flagged with removal guidance. NEW: security.txt detection — checks for RFC 9116 security contact file at /.well-known/security.txt. NEW: Redirect chain grading — redirect quality scored by hop count and HTTP/HTTPS transitions. IMPROVED: Domain-grouped history — scans organized by domain with drill-down detail view. IMPROVED: Collapsible results sections — cleaner, scannable results with report card summary strip. IMPROVED: v2 scoring algorithm — 60% headers / 20% SSL / 20% cookies for sites with cookies. ### 1.1 — 2026-03-17 NEW: 3-day PRO trial on first launch — experience every feature before you buy. NEW: Batch scanning — scan up to 50 URLs at once with an aggregate security report sorted worst-first. See your entire portfolio's health in seconds. NEW: Shareable grade badge — generate a shields.io-style SVG/PNG security badge for your site's README, Slack, or CI dashboard. NEW: iPad compare mode — select two scans from History and view them side-by-side with per-header improvement/regression indicators. IMPROVED: Redesigned paywall with benefit-driven copy — see exactly what PRO lets you DO, not just a feature list. IMPROVED: Smarter PRO gating — code snippets and trend arrows now require PRO. Full WHAT/WHY/FIX diagnostics and scan history remain free. IMPROVED: 4-tab layout — Scan, Batch, History, Tools. ## Apps similar to GuardPad | App | Rating | Price | Category | | --- | --- | --- | --- | | [HookTap](https://appshunter.io/ios/app/hooktap/id6759625475) | — | Free | Developer Tools | | [Serverhub.dev](https://appshunter.io/ios/app/serverhubdev/id6740012884) | — | Free | Developer Tools | | [PocketTM](https://appshunter.io/ios/app/pockettm/id6744907173) | — | Free | Developer Tools | | [FixList - Dev Tasks](https://appshunter.io/ios/app/fixlist-dev-tasks/id6761732712) | — | Free | Developer Tools | | [SnippetBox](https://appshunter.io/ios/app/snippetbox/id6760775089) | — | Free | Developer Tools | | [NomadFlowCode](https://appshunter.io/ios/app/nomadflowcode/id6758987619) | — | Free | Developer Tools | ## More apps by Olof Petterson - [ProbePad - API Client](https://appshunter.io/ios/app/probepad-api-client/id6757448741) - [Clearstep](https://appshunter.io/ios/app/clearstep/id6758252816) - [Soft Landing](https://appshunter.io/ios/app/soft-landing/id6758314879) - [Remynder](https://appshunter.io/ios/app/remynder/id6758546254) - [BeaconPad](https://appshunter.io/ios/app/beaconpad/id6759147151) All apps by Olof Petterson: https://appshunter.io/developer/1808256024 ## Related topics [security scanner](https://appshunter.io/ios/topics/security-scanner) · [security scan](https://appshunter.io/ios/topics/security-scan) · [ssl lock](https://appshunter.io/ios/topics/ssl-lock) --- *Data collected daily from the US App Store and indexed by [AppsHunter](https://appshunter.io/). User reviews are verbatim App Store reviews. Ratings, prices and chart positions refresh continuously; this snapshot is from 2026-08-13.*