I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here:


When I put the URL to my site into here it says everything is good. Is this sufficient for determining if one's site is vulnerable or should I be doing something else?

  • You can do the same offline (by running ssltest.py or Valsorda's go run bleed.go). – Deer Hunter Apr 14 '14 at 18:55

The SSL Labs test will give you the most information about your site, including heartbleed status: https://www.ssllabs.com/ssltest/analyze.html?d=

This site has worked pretty well for me in testing specifically for heartbleed: http://possible.lv/tools/hb/

Lastpass uses some other assumptions about previous information to make pretty good guesses: https://lastpass.com/heartbleed/

| improve this answer | |

A lot of the tests seem to be buggy according to this article here: http://cryptogasm.com/2014/04/whats-worse-than-heartbleed-bugs-in-heartbleed-detection-scripts/

I would rather test it with a script yourself to be sure: https://gist.github.com/ah8r/10632982

You could compare with the servers of www.cloudflarechallenge.com as a reference. They do heartbleed by intention.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.