1

I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here:

https://filippo.io/Heartbleed/

When I put the URL to my site into here it says everything is good. Is this sufficient for determining if one's site is vulnerable or should I be doing something else?

Abe Miessler
  • 8,155
  • 10
  • 44
  • 72

2 Answers2

1

The SSL Labs test will give you the most information about your site, including heartbleed status: https://www.ssllabs.com/ssltest/analyze.html?d=

This site has worked pretty well for me in testing specifically for heartbleed: http://possible.lv/tools/hb/

Lastpass uses some other assumptions about previous information to make pretty good guesses: https://lastpass.com/heartbleed/

cscracker
  • 314
  • 1
  • 3
0

A lot of the tests seem to be buggy according to this article here: http://cryptogasm.com/2014/04/whats-worse-than-heartbleed-bugs-in-heartbleed-detection-scripts/

I would rather test it with a script yourself to be sure: https://gist.github.com/ah8r/10632982

You could compare with the servers of www.cloudflarechallenge.com as a reference. They do heartbleed by intention.

binaryanomaly
  • 1,291
  • 3
  • 13
  • 21