OBSERVATORYv0.10.0

Survey your website

Enter your web address and OBSERVATORY charts what an outsider can see, then explains each finding in plain language: what it is, why it matters to your business, and who fixes it.

Site surveyed: not yet

Active scan

Full audit (site survey plus live port scan)

This runs the full site survey and adds a live port scan of your server, in one report. The survey uses public data and sends nothing to your server. The port scan connects to your server directly, so it only runs against a domain you have proven you control, and that proof is checked by the LEADSMAN helper on your own machine, not by this page.

This runs against the website address entered above: the address entered above. It must be a site you own.

Generate a token to begin.

Prove you own the domain using either method, then run the scan.

Option A, DNS record

Add this as a TXT record on your domain, at host _observatory-verify:

observatory-site-verification=(generate a token)

Some DNS providers, Cloudflare among them, require the value wrapped in double quotes. If yours does, paste this form instead:

"observatory-site-verification=(generate a token)"

Option B, file upload

Put a file at /.well-known/observatory-verify.txt on your site containing:

observatory-site-verification=(generate a token)
OBSERVATORY carries the helper inside it. Save it, then run: python3 leadsman.py

No survey yet. Enter your website address above and OBSERVATORY will chart what it sees.

DEBUG LOG

  

OBSERVATORY runs on your device. When you run a live survey, only the website address you enter is sent to the audit service you configured. Nothing else leaves your computer.

About OBSERVATORY

A plain-language security survey for small business websites. Point it at your site, understand what an outsider can see, and get a clear list of what to fix and who fixes it.

Version

v0.10.0

License

GPL-3.0

Libraries

None. Vanilla HTML, CSS, and JavaScript, single file, no build step.

Data sources

Header, cookie, and redirect findings are read directly by the audit service from what your site returns to a normal request.

Deep scan

The optional live port scan runs through LEADSMAN, a small helper you run yourself. It refuses to scan any domain until you prove you control it, and that check happens in the helper, not in this page.

Feedback

Send notes, false readings, or wishlist items to the project repository issue tracker (link added at publish).

Embedded art

Wordmark, reticle, and state glyphs are original inline SVG authored for this project, GPL-3.0.

Self-test

Runs the core logic checks that must pass before any release.

Not run yet.