Testing your site for the heartbleed vulnerability?

Question

I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here:

https://filippo.io/Heartbleed/

When I put the URL to my site into here it says everything is good. Is this sufficient for determining if one's site is vulnerable or should I be doing something else?

You can do the same offline (by running ssltest.py or Valsorda's go run bleed.go). — Deer Hunter, Apr 14 '14 at 18:55

score 1 · Accepted Answer · answered Apr 14 '14 at 20:09

The SSL Labs test will give you the most information about your site, including heartbleed status: https://www.ssllabs.com/ssltest/analyze.html?d=

This site has worked pretty well for me in testing specifically for heartbleed: http://possible.lv/tools/hb/

Lastpass uses some other assumptions about previous information to make pretty good guesses: https://lastpass.com/heartbleed/

score 0 · Answer 2 · answered Apr 14 '14 at 19:50

A lot of the tests seem to be buggy according to this article here: http://cryptogasm.com/2014/04/whats-worse-than-heartbleed-bugs-in-heartbleed-detection-scripts/

I would rather test it with a script yourself to be sure: https://gist.github.com/ah8r/10632982

You could compare with the servers of www.cloudflarechallenge.com as a reference. They do heartbleed by intention.

Testing your site for the heartbleed vulnerability?

2 Answers2