soapui.org
FThe World’s Most Popular API Testing Tool | SoapUI
SoapUI is the world’s most widely-used automated testing tool for SOAP and REST APIs. Write, run, integrate, and automate advanced API Tests with ease. See why millions of users trust SoapUI for testing their APIs today!
Built with
- Frontend framework
- Astro
- Generator tag
Astro v5.18.2
Also detected
- Libraries
- Tailwind CSS
- Infrastructure
- Cloudflare
- Third-party services
- Google Tag Manager
Overview
- Status
- alive
- Registered
- 2005-09-05 (21 years ago)
- First seen here
- 2026-09-22
- Security grade
- F (55/100, from headers & TLS)
- Privacy score
- 78/100 (2 third-party script hosts, 1 tracking/marketing services)
- Hosting
- Cloudflare, Inc. · AS13335 · Canada
- Server header
cloudflare- Response time
- 72 ms to first byte, measured from our crawler
- TLS certificate
- Google Trust Services · TLSv1.3 · expires 2026-11-20
- Language
- en
- Mobile-ready
- yes (viewport meta tag)
- Linked to from
- 6 other sites seen so far
Loads scripts from
Third-party domains this page pulls JavaScript or iframes from. Each one can see who visits.
convertexperiments.comcloudflareinsights.com
What to fix
- Add Strict-Transport-Security
Header: Strict-Transport-Security: max-age=31536000; includeSubDomains - Add a Content-Security-Policy
Limits which scripts can run, and is the main defense against XSS. Start with Content-Security-Policy-Report-Only to test. - Prevent clickjacking
Header: X-Frame-Options: DENY (or a CSP frame-ancestors directive).
Security & email signals
- ✓ HTTPS
- ✗ HSTS
- ✗ Content-Security-Policy
- ✓ X-Content-Type-Options
- ✗ X-Frame-Options
- ✓ Referrer-Policy
- ✗ Permissions-Policy
- ✓ SPF record
- ✓ DMARC record
- ✗ DKIM record
- ✓ Cookies set securely
- ✓ Has real content (not an empty shell)
- ✓ Valid TLS certificate
Badge
Show this site's security grade in a README or footer:

<a href="https://webtelemetry.dev/site/soapui.org"><img src="https://webtelemetry.dev/badge/soapui.org.svg" alt="Security grade"></a>
Generated automatically from passive, publicly observable data. Think something here is wrong or want this profile removed? See /bot. Machine-readable: JSON.