Security
Checked in public.
Independent scanners test thinkr.sh in the open. Each result links to its live test, so you can run it yourself.
Checked on 20 Oct 2026
Scans
Every test, and its result.
Run any of them yourself: the links open the live test of thinkr.sh.
Qualys SSL Labs
A+
TLS on all four Cloudflare addresses
Run the testMozilla HTTP Observatory
A+
Score 120 of 100 · 12 of 12 tests passed
Run the testSnyk Security Headers
A+
Headers include CSP, HSTS, and X-Frame-Options DENY
Run the testDNSViz
Valid
DNSSEC validated by 1.1.1.1, 8.8.8.8, and 9.9.9.9
Run the testThe Markup Blacklight
0
Ad trackers and third-party cookies. No canvas fingerprinting, session recording, keystroke capture, or Facebook, TikTok, or X pixel.
Run the testWebbkoll
0
Third-party requests and cookies. HTTPS by default, no referrer leaks, and a good Content Security Policy.
Run the test
The setup
What protects this site.
Set on the server and at the edge, and true today.
- TLS
- 1.2 and 1.3 only
- HTTPS
- Forced · HSTS one year
- Origin
- Cloudflare only, mutual TLS
- DNS
- DNSSEC · CAA
- Scripts
- thinkr.sh only, by hash
- Framing
- Blocked · X-Frame-Options DENY
- Third-party requests
- 0
- Request logs
- None
These checks cover this website. How a chat stays private is on the privacy page.