// security.toolkit

Free tools for SMB security awareness, powered by Breach

// HTTP SECURITY HEADERS

Enter a domain or URL to check which security headers are present. Missing headers are common on small business sites and leave users exposed to basic attacks.

// WHY HEADERS MATTER

HSTS: forces HTTPS, prevents attackers from stripping encryption
CSP: limits which scripts can run, blocks injected malicious code
X-Frame-Options: prevents your page being loaded inside attacker-controlled iframes
X-Content-Type-Options: stops browsers from misinterpreting file types
Referrer-Policy: controls what URL info leaks to third parties
Permissions-Policy: restricts access to camera, mic, and location APIs

// WHAT IS PHISHING?

Phishing is a social engineering attack where criminals impersonate trusted entities (banks, employers, delivery companies) to steal credentials, financial information, or install malware.

It's the most common entry point for ransomware and data breaches. Over 90% of successful cyberattacks begin with a phishing email.

// RED FLAGS IN PHISHING EMAILS

Urgency and pressure: "Your account will be suspended in 24 hours." Attackers create panic to short-circuit critical thinking.
Generic greetings: "Dear Customer" or "Dear User" instead of your name means a mass campaign.
Mismatched sender domains: Email from "support@paypa1.com" or "noreply@amazon-security.net." Look at the actual domain, not the display name.
Hover before you click: Hover any link before clicking. The URL shown in your status bar should match where you expect to go.
Unexpected attachments: Invoice PDFs, shipping notifications, or HR documents you weren't expecting are a classic vector.
Requests for credentials: Legitimate services never ask for your password via email.
Spelling and grammar errors: Professional organizations proofread. Attackers often don't.
Too good to be true: Lottery winnings, unclaimed packages, inheritance notices. These are bait.

// URL ANALYZER

Paste a suspicious URL to check for common phishing indicators. Analysis is client-side only; the URL is not visited or fetched.

// HOW TO VERIFY A LINK SAFELY

Hover the link: check the actual destination in your browser status bar
Look for the real domain in the URL: paypal.com vs paypal.security-update.com. The real domain is just before the first single slash
Check for HTTPS: a padlock icon means the connection is encrypted, not that the site is trustworthy
Use Google Safe Browsing or VirusTotal to check URLs before opening
When in doubt, navigate directly: type the URL manually instead of clicking the link