GuardPad vs Hammer

See what needs fixing on your site — and verify the improvement. GuardPad scans a website's security configuration from your iPhone or iPad, shows the three fixes that matter most, explains each one in plain language, and — after you change your server — rescans and tells you finding by finding what is resolved, still present, new, or could not be verified. Built for freelance developers and small web agencies who look after client sites. Try every PRO feature free for 3 days. No account. No analytics. Scans run on your device. UNDERSTAND • An A+ to F grade that summarises the checks performed — with a clear note that a grade is not a guarantee of security or a certification • 11 graded HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, X-XSS-Protection, Server) • SSL/TLS certificate and protocol details, including post-quantum key exchange detection • Cookie flags (Secure, HttpOnly, SameSite, __Host- prefix) • Email security: SPF, DMARC, DKIM, MTA-STS and BIMI • Redirect chain, deprecated headers, security.txt, WAF/CDN fingerprints • OWASP Top 10:2025 and PCI DSS 4.0 header check mapping FIX • "Fix first" — your highest-impact issues at the top of the results • For every finding: what was observed, why it matters, and what to change • PRO: server config snippets for nginx, Apache, Express.js and Caddy VERIFY • Rescan to verify: each earlier finding is marked Resolved, Still present, New or Not verified • An unchanged overall grade never hides a finding you fixed • Incomplete scans (for example when the web server is unreachable) are never counted as fixed • PRO: PDF and Markdown reports that include what was verified since the previous scan FOLLOW UP (PRO) • Pin up to 5 domains; when iOS allows, GuardPad re-scans them in the background and notifies you only when a grade or header changes. Each pinned domain shows when it was last checked. Background re-scans are periodic, not continuous. Yearly covers all pinned domains; Lifetime covers 1. • Certificate expiry reminders 30/14/7/3/1 days before expiry • Grade trend charts, posture dashboard and scan comparison • Batch scan up to 50 URLs, CORS tester, DNS lookup with DNSSEC and CAA, full certificate chain • Shareable grade card and README badge NATIVE ON iOS • Share Extension — scan a URL straight from Safari • Siri & Shortcuts — "Scan Domain" and "Get Last Grade" • Home Screen and Lock Screen widgets for pinned domains • Optimised for iPhone and iPad FEEDBACK Spotted an incorrect result? Report it from the finding itself. You see the full message before anything is shared, and you send it yourself from Mail. PRIVACY No account, no analytics SDKs, no tracking, no third-party dependencies. Scan results stay on your device. GuardPad is a tool for checking the configuration of websites you own or are permitted to scan. Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ Privacy Policy: https://olofpetterson.github.io/op-apps/guardpad/privacy.html?lang=en

Hammer is a professional HTTP and HTTPS debugging toolkit for developers, QA engineers, mobile teams, and technical users who need a clear way to inspect, analyze, and troubleshoot network traffic on iPhone and iPad. Whether you are testing an API, debugging a mobile app, checking request headers, reviewing response data, or exporting sessions for deeper analysis, Hammer helps you understand what is happening between your app, website, and backend services. Designed for local-first network inspection, Hammer keeps captured data on your device by default. Requests, responses, headers, cookies, and session history remain local unless you choose to export or share them. How Hammer Works: Hammer uses Apple's public Network Extension framework and a Packet Tunnel Provider to enable on-device traffic capture. When you tap Start and approve the iOS system configuration prompt, Hammer creates a local Packet Tunnel. Traffic included in the active capture session is routed through Hammer's local proxy process on the same device, where requests and responses can be inspected and displayed. The Packet Tunnel does not connect your traffic to a remote VPN server. Hammer does not provide anonymous browsing, change your virtual location, or hide your public IP address. iOS displays VPN-related permission text and may show a VPN status indicator because Apple manages Packet Tunnel Provider configurations through its VPN configuration infrastructure. Key Features: Live Traffic Capture Capture HTTP and HTTPS requests in real time. Review method, host, path, status code, protocol, timing, size, and request details in a clean debugging interface. Detailed Request Inspector Inspect URL parameters, request and response headers, message bodies, status codes, timing metrics, and content types. HTTPS Debugging Use optional certificate-based HTTPS inspection in development, testing, or other authorized environments. Certificate installation and trust are controlled by the user through iOS Settings. Request History Keep capture sessions organized locally so you can revisit traffic, compare results, and investigate issues after testing. Rules and Filters Manage rules for bypassing hosts, blocking traffic, rewriting requests, mapping responses, and controlling traffic during debugging. HAR Export Export captured sessions as HAR files for desktop analysis, bug reports, team collaboration, or long-term debugging records. Local Proxy Workflow Use Hammer's on-device Packet Tunnel and local proxy workflow to inspect traffic from apps, browsers, and services you are authorized to analyze. Clean Debugging Interface Work with readable request lists, structured detail views, protocol statistics, favorites, and practical tools for repeated debugging. Local-First Privacy Captured network content is processed and stored locally by default. Hammer does not require an account, and the Packet Tunnel does not upload captured traffic to a remote VPN server. Data leaves your device only when you explicitly export, share, or submit it through a user-initiated action. Hammer is useful for: • Debugging mobile app API requests • Inspecting HTTP and HTTPS traffic • Reviewing headers, cookies, and response bodies • Testing backend services and REST APIs • Checking status codes, redirects, and timing • Exporting HAR files for issue reports • Managing traffic rules during development • Investigating network behavior during QA testing Hammer is intended for legitimate development, testing, and debugging workflows. Use it only with apps, websites, services, and network traffic that you own or have permission to inspect.