Fetches one page from our server and shows which trust signals a visitor can find on it: HTTPS, a privacy policy and terms, contact details, social proof and a few security headers. For founders and marketers whose visitors hesitate to sign up or buy. It is not a security check.
How to use it
Enter the address of a page a new visitor sees, such as your home page or pricing page. You can leave out https://.
- Type or paste the address of the page and press Run check.
- Read the list of signals the page shows and the ones it does not.
- Start with the critical and warning findings. Each one says what to add or change.
- Change the page, then run the check again.
How Reavlo tests this
This is not a security check. The tool lists the signals a visitor can see and a few response headers that are good practice. It does not scan for vulnerabilities, test your server or certificate, or tell you a site is safe or secure. A page can show every signal here and still be insecure, and a safe page can lack some of them.
This tool runs on our server, because a browser cannot read another site's page or response headers. Nothing about the request is stored or logged: not the address, not the page.
Fetching. One request to the page, with up to 3 redirects, a size cap and a time limit. Addresses that point to private or internal networks are refused before any connection is made.
HTTPS. The final address, after redirects, must use https. When it does, the Strict-Transport-Security header is looked for as a warning. See MDN on HSTS.
Policies and contact. The links on the page are read. A link whose address or text mentions privacy counts as a privacy policy; one that mentions terms, conditions or legal notice counts as terms. A mailto: or tel: link, or a link labelled contact, support or "get in touch", counts as contact details. The tool does not open those pages or judge what they say.
Social proof. Wording such as testimonials, reviews, "trusted by", customers, case studies or a customer count in the visible text, or Review or AggregateRating markup in the page's JSON-LD (Google's review snippet guide). Whether the proof is real is not checked.
Security headers. X-Content-Type-Options, framing protection (X-Frame-Options or frame-ancestors), Content-Security-Policy and Referrer-Policy, following the OWASP Secure Headers Project. They are reported as information only.
Limits. The tool reads one page as the server sent it and does not run JavaScript, so a footer added by a script is not seen. Other languages are matched only by a few common words. Only the page you enter is read, not the rest of the site.
Questions
Is this a security scan?
No. It does not probe your site or look for vulnerabilities. It reads one page and its headers to see which trust signals a visitor can find. A clean result does not mean the site is secure.
Is the address I enter stored?
No. The address goes to our server only to fetch the page, and neither it nor the page is stored or written to a log. Analytics records only that the tool ran, never the address.
Why does it say there is no privacy policy when I have one?
The tool looks for a link on the page whose address or text mentions privacy. If your policy is linked from a script-built footer or under another word, it is not seen. Add a plain link with the word privacy in the footer.
Do I need every signal on the list?
No. Which ones matter depends on what you sell. A page that takes payments or personal details needs more than a simple brochure page. The findings are ordered by how much a visitor is likely to notice.
Where do I check my email authentication?
Email authentication is a different check. The SPF, DKIM and DMARC checker reads your domain's DNS records.