# Web Recon — Measure your web site security

> Measure your web site security (iPhone/iPad app by Brian Reed.)

- Source: https://appshunter.io/ios/app/web-recon/id6811734853 (this page in markdown: same URL + `.md`)
- Developer: [Brian Reed](https://appshunter.io/developer/6775352024)
- Category: Utilities, Developer Tools
- Price: $4.99
- Age rating: 4+
- Requires: iOS 17.0 · 4 MB
- Languages: American English
- Released: 2026-10-03
- Data updated: 2026-10-14

## What is Web Recon?

One letter. And exactly what to change.

Web Recon grades a website's security posture end to end and tells you, in order, what to fix. You get a grade, the reason behind it, and the single change that raises it most.

WHAT IT CHECKS

• Transport — HTTPS enforcement, TLS version, legacy protocol support, certificate validity and expiry, key strength, OCSP stapling, the full HSTS policy including preload eligibility, and whether the page pulls anything over plaintext.
• Headers — Content-Security-Policy and whether it actually constrains anything, including whether its allowlist can be walked straight through; Subresource Integrity on third-party scripts; MIME sniffing, framing, Referrer-Policy, Permissions-Policy and cross-origin isolation.
• Cookies — Secure, HttpOnly and SameSite judged per cookie, plus __Host- and __Secure- prefixes and over-broad Domain scope.
• Redirect chain — length, plaintext hops, cross-origin handoffs and open-redirect patterns.
• Information exposure — version banners, X-Powered-By, debug headers and directory listings.
• Ownership — registration expiry, registrar and ASN, CAA records, DNSSEC.

IT ASKS WHETHER YOUR CSP ACTUALLY WORKS

Plenty of tools will tell you whether a Content-Security-Policy exists. Web Recon asks whether it works. A policy that allowlists a shared bucket domain, or a CDN serving arbitrary packages, hands script execution to anyone who asks: it looks strict and stops nothing. The same goes for a script loaded from someone else's server with no integrity hash. polyfill.io was a script on six figures' worth of sites when the domain changed hands, and the new owner served malware to all of them.

THE FIX LIST IS THE PRODUCT

Every failing check tells you why it matters, what was observed, and the exact configuration to set, ready to copy. The list is ranked by how much each change raises the grade, so you can start at the top and stop when you like.

SEE WHETHER YOUR FIX WORKED

Re-run and compare. Web Recon shows the delta, the grade change, and the part nobody thinks to check: anything that was passing before and isn't now.

HONEST ABOUT WHAT IT DOESN'T KNOW

When a registry rate-limits us, a resolver strips the records we need, or a page runs too long to read to the end, that check is reported as not evaluated and left out of the score. It is never counted against your site, and never counted in your favor either. A partial grade says so on its face.

ON IPHONE AND IPAD

The grade leads and the evidence is one tap away. iPad runs three panes side by side in landscape.

With Wi-Fi and cellular both up, Web Recon inspects the certificate over each path and tells you when they disagree, which is how you catch something terminating TLS on one of them.

BUILT FOR ONE JOB

One site at a time, on your say-so. Web Recon fetches your site's front page and follows its redirects. It does not crawl, enumerate paths, guess filenames or probe for vulnerabilities. There is no account, no telemetry and no analytics, and nothing is uploaded. Your history stays on your device.

Export any report as Markdown, JSON or PDF.

Part of the 404 Tools Recon line. Hands off to, and takes handoffs from, HTTP Recon, Cert Recon, WHOIS Recon and DNS Recon.


## Version history (last 1 release)

### 1.0 — 2026-10-04

No release notes.

## More apps by Brian Reed

- [IP Recon](https://appshunter.io/ios/app/ip-recon/id6775352022)
- [Cert Recon](https://appshunter.io/ios/app/cert-recon/id6779392135)
- [DNS Recon](https://appshunter.io/ios/app/dns-recon/id6779392375)
- [Packet Recon](https://appshunter.io/ios/app/packet-recon/id6779393192)
- [SNMP Recon](https://appshunter.io/ios/app/snmp-recon/id6779393528)
- [WiFi Recon](https://appshunter.io/ios/app/wifi-recon/id6779393537)

All apps by Brian Reed: https://appshunter.io/developer/6775352024

---

*Data collected daily from the US App Store and indexed by [AppsHunter](https://appshunter.io/). User reviews are verbatim App Store reviews. Ratings, prices and chart positions refresh continuously; this snapshot is from 2026-10-14.*