1

This question already has an answer here:

I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here:

https://filippo.io/Heartbleed/

When I put the URL to my site into here it says everything is good. Is this sufficient for determining if one's site is vulnerable or should I be doing something else?

marked as duplicate by Xander, dr jimbob, Steve, TildalWave, AJ Henderson Apr 15 '14 at 13:28

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • You can do the same offline (by running ssltest.py or Valsorda's go run bleed.go). – Deer Hunter Apr 14 '14 at 18:55
1

The SSL Labs test will give you the most information about your site, including heartbleed status: https://www.ssllabs.com/ssltest/analyze.html?d=

This site has worked pretty well for me in testing specifically for heartbleed: http://possible.lv/tools/hb/

Lastpass uses some other assumptions about previous information to make pretty good guesses: https://lastpass.com/heartbleed/

0

A lot of the tests seem to be buggy according to this article here: http://cryptogasm.com/2014/04/whats-worse-than-heartbleed-bugs-in-heartbleed-detection-scripts/

I would rather test it with a script yourself to be sure: https://gist.github.com/ah8r/10632982

You could compare with the servers of www.cloudflarechallenge.com as a reference. They do heartbleed by intention.

Not the answer you're looking for? Browse other questions tagged or ask your own question.