ApiCatcher vs SiteGrade

ApiCatcher is a user-friendly mobile HTTP/HTTPS/WS/WSS packet capture and debugging tool. ApiCatcher also offers macOS and Windows versions (ApiCatcher Desktop), and the ApiCatcher can sync captured traffic to ApiCatcher Desktop in real time. [Key Features] • Traffic Capture: Capture HTTP, HTTPS, WS, and WSS traffic (WS: WebSocket; WSS: WebSocket over TLS). • Data Manipulation: Copy, export, encrypt, and decrypt Query Params, Headers, and Bodies. • Host Filtering: Configure blacklists and whitelists to filter captured hosts. • Request Replay: Modify and resend requests. • Combo Replay: Schedule and execute multiple requests sequentially based on dependencies, with support for dynamic parameter injection. • Scheduled Replay: Automate and trigger request replays at set intervals. • Auto-Generated API Docs: Automatically generate API documentation and export directly to Postman or Apifox. • Rewrite Rules: Mock responses, redirect requests, modify requests/responses, or drop requests/responses. • Scripting Engine: Extend capabilities with script plugins to flexibly modify requests and responses on the fly. • History Export: Batch export captured traffic as HAR files. • API Scanner: Run rule-based vulnerability/error detection and statistics on captured traffic, with support for custom scanning rules. • Media Export: Batch export images and videos, with automatic merging for segmented download requests. • Real-Time Sync: Stream captured HTTP/HTTPS traffic instantly to ApiCatcher Desktop for advanced analysis and debugging. It also supports syncing to Burp Suite, which requires installing the plugin provided by ApiCatcher on Burp Suite. • DNS mapping/spoofing: Bypass DNS resolution by sending requests for specified domain names to a designated IP address, achieving an effect similar to editing the hosts file on a computer. • Support decoding request/response bodies encoded with the Protobuf protocol, such as gRPC requests. If a .desc descriptor file is provided, field names can also be decoded. [Personalization Settings] • Configurable code highlighting styles with multiple built-in themes, supporting JSON/XML/HTML/JS. • AI assistant mode available: directly capture and analyze packets through AI dialogue. [How It Works] ApiCatcher establishes a local VPN connection on your device to route all network traffic through a local Man-in-the-Middle (MITM) service. As long as the VPN is active, ApiCatcher can capture any HTTP/HTTPS/WS/WSS traffic passing through Wi-Fi or cellular data. [Data Privacy & Security] ApiCatcher's root certificate is a self-signed certificate generated entirely on your own device. All captured HTTP/HTTPS/WS/WSS data is stored locally on your device and is never uploaded to any remote servers. [Description of automatic subscription service] 1.Subscription service: a) Ultimate Monthly (1 month) b) Ultimate Yearly (12 months) 2.Payment: After the user confirms the purchase and makes payment, it will be credited to the iTunes account 3.Automatic renewal: Apple iTunes account will be charged within 24 hours before the expiration date, and the subscription period will be extended by one subscription period after the successful deduction 4.Close the service: You can close the service by going to "Settings" on your iPhone, entering "iTunes Store and App Store", clicking on "Apple ID", selecting "View Apple ID", entering the "Account Settings" page, clicking on "Subscriptions", and managing automatic subscription services. If you need to cancel, you can close it 24 hours before the end of each billing cycle, and no further charges will be deducted within 24 hours before the expiration date 5.Service Agreement: https://apicatcher.net/en/terms-of-service 6.Privacy Agreement: https://apicatcher.net/en/privacy-policy

SiteGrade checks the security configuration a website serves to browsers, grades it A to F, and explains every finding in plain English with the exact change to make. Type a domain on iPhone or iPad, or share a page straight from Safari, and the answer takes seconds. One purchase also covers Mac. WHAT IT CHECKS Security headers - Content-Security-Policy, including report-only policies - Strict-Transport-Security (HSTS), with max-age and includeSubDomains - X-Content-Type-Options - X-Frame-Options and CSP frame-ancestors - Referrer-Policy - Permissions-Policy - Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy - Server and framework version disclosure - Legacy X-XSS-Protection TLS/SSL certificate - Chain validity, trusted root, self-signed and hostname-mismatch detection - Expiry date, with a warning well before it becomes an outage - Negotiated protocol version, TLS 1.0 through TLS 1.3 Transport - Whether plain HTTP redirects to HTTPS, asked on port 80 directly - The full redirect chain, including cross-host and downgrading hops - Mixed content: the page loads in an isolated web view and every insecure subresource request is recorded, active and passive DNS and email - A, AAAA, CNAME and MX records - SPF and DMARC presence and policy - Reported as information only. DNS and email findings never move the letter grade. EXPLAINED, NOT DUMPED Every finding answers three questions: what it means, why it matters, and how to fix it, with copy-ready nginx and Apache values and a command to confirm the fix landed. There is also a fix prompt written from your own report that you can hand to a coding agent. THE GRADE SHOWS ITS WORK Points, caps and bands come from a rubric published inside the app on a "How grading works" screen, so you can always answer "why a B?". Every finding shows the raw evidence behind it: the header value received, the certificate fields, the DNS answers. FREE AND PRO Checking sites is free and unlimited, and every free check shows the grade and the full finding list. Pro is a one-time purchase, never a subscription. It covers iPhone, iPad and Mac, and it is shareable with your family. Pro unlocks: - Every finding's plain-English explanation, fix snippet and evidence - History, kept on your device and grouped by domain, so a grade has a trend instead of a moment - Compare, so a re-check shows what was fixed, what regressed and what is new - Export of the full report as Markdown or PDF, and the fix prompt PRIVATE BY CONSTRUCTION No accounts, no servers, no analytics, no trackers, no ads. Nothing you check is sent to us, because there is nowhere for it to go. Your reports stay on your device. HONEST ABOUT SCOPE This grade reflects the security configuration a site serves to browsers. It is not a security audit. Every check is passive and read-only: a GET request, one TLS handshake, DNS lookups and one page load, which is the same traffic a browser makes when it opens the page. SiteGrade is built for checking your own site or a site you manage. Terms of Use: https://joneslabs.dev/terms