ABOUT
404NOT403 is a forensic HTTP instrument. It bypasses browser interpretation and captures what a server actually returned — status codes, headers, TLS certificates, CDN layers, and WAF behavior — directly from the source.
Most tools show you what the browser decided to render. This tool shows you what the server actually said.
WHO THIS IS FOR
SECURITY
Security researchers and pentesters
Verify how a server responds before and after configuration changes. Detect WAF interference, certificate expiry, and header misconfiguration.
DEVOPS
Engineers monitoring production endpoints
Track status code changes over time. Know when a 200 becomes a 403, or when a page silently disappears behind a CDN cache.
LEGAL
Compliance teams and digital investigators
Capture forensic evidence of what a URL returned at a specific point in time. Body hash fingerprinting proves whether content changed.
FOUNDERS
Product builders watching competitors and dependencies
Monitor third-party URLs your product depends on. Get notified when APIs, landing pages, or documentation endpoints change or go down.
SECURITY ARCHITECTURE
256
BIT SECURITY
Enterprise-grade identity and session security. No shortcuts. No compromises.
PASSWORDS
Argon2id — OWASP 2024+ recommended
Memory-hard password hashing. Resistant to GPU and ASIC brute-force attacks.
SESSIONS
RS256 JWT — 4096-bit RSA, HttpOnly, Secure, SameSite=Strict
Asymmetric JWT signing. Cookies are invisible to JavaScript and locked to the origin domain.
MFA
TOTP (RFC 6238) + AES-256-GCM encryption at rest
Time-based one-time passwords with secrets encrypted before storage. Compatible with any authenticator app.
SSRF
Private IP blocking, metadata endpoint protection, DNS rebinding defense
The scan engine cannot be weaponized against internal networks. All targets are validated before connection.
XSS
Zero innerHTML with external data — textContent only
All user-facing data is rendered via safe DOM APIs. No injection vector exists in the rendering pipeline.
RBAC
Observer → Analyst → Admin
Role-based access control enforced at the middleware layer. Every protected route checks identity and permission level.
SYSTEM ARCHITECTURE
REQUEST FLOW
CLIENT
Browser or API key
EDGE
Railway load balancer — TLS termination
MIDDLEWARE
Rate limiter → Logger → Auth (JWT or API key) → RBAC
HANDLER
Route-specific logic — scan, monitor, auth, billing
ENGINE
Forensic scanner — headers, TLS, CDN, WAF, body hash
STORE
PostgreSQL — scans, monitors, changes, users, API keys
WORKER
Background goroutine — scheduled checks, change detection, graceful shutdown
BUILT BY
BUILDER
David Vasquez
Systems engineer. 5+ years securing enterprise identity infrastructure at scale. DARPA-funded training.
STACK
Go · PostgreSQL · Railway · Stripe · Resend
No frameworks. No abstractions. Direct HTTP, raw SQL, manual JWT signing. Built for control, not convenience.
SOURCE
PRICING
FREE
Observer Tier
Unlimited public scans. Global activity feed. Up to 3 monitors with 24-hour check intervals.
$19/MO
Analyst Tier — Pro
Private scan history. Up to 50 monitors. 1-hour, 6-hour, or 24-hour check intervals. Priority support.