Change Password Well-Known URL Auditor

Audits whether a public domain implements the W3C/WHATWG specification for a well-known URL for changing passwords (/.well-known/change-password) and returns a readiness score, letter grade, issues, and recommendations as structured JSON.

Use cases

• Security and identity engineering teams verifying that /.well-known/change-password correctly redirects to the real password-change page
• Password manager vendors and browser teams sampling adoption of the convention across customer or partner domains
• Site migration QA confirming the well-known redirect survives an identity-provider or account-settings URL change
• Agency consultants running recurring account-security audits across client domains
• CI pipelines gating releases on regressions to the well-known redirect

Input

Field	Type	Default	Description
startUrl	string	(required)	Public domain or URL to audit. Only the scheme and host are used; the actor always requests /.well-known/change-password on that host.
timeoutSeconds	integer	10	Request timeout per request, from 3 to 30 seconds.
followRedirectTarget	boolean	true	When the well-known URL redirects, also fetch the redirect target once to confirm it returns a successful response.

Output

One dataset item per run:

Field	Type	Description
inputUrl	string	URL as provided in the input.
wellKnownUrl	string or null	The resolved /.well-known/change-password URL that was requested.
https	boolean or null	Whether the well-known URL was requested over HTTPS.
ok	boolean	Whether the audit completed without a fetch or validation error.
checkedAt	string	ISO 8601 timestamp of the check.
httpStatus	integer or null	HTTP status of the well-known response.
classification	string	One of: redirect, redirect-missing-location, direct-serve, not-found, unexpected-status, unreachable.
isRedirect	boolean	Whether the well-known URL returned a 3xx status.
isDirectServe	boolean	Whether the well-known URL served a 200 response directly instead of redirecting.
redirectLocation	string or null	Raw Location header value from the well-known response.
redirectTargetUrl	string or null	The redirect Location resolved to an absolute URL.
redirectIsHttps	boolean or null	Whether the redirect target is an HTTPS URL.
sameOriginRedirect	boolean or null	Whether the redirect target is on the same host as the audited domain.
redirectTargetChecked	boolean	Whether the actor fetched the redirect target to confirm it loads.
redirectTargetReachable	boolean or null	Whether the redirect target returned a successful response.
redirectTargetStatus	integer or null	HTTP status of the redirect target fetch.
redirectTargetError	string or null	Error message if the redirect target fetch failed.
contentType	string or null	Content-Type of the well-known response.
score	integer	Readiness score from 0 to 100.
grade	string	Letter grade from A+ to F.
issues	array	Concrete problems found.
recommendations	array	Actionable fixes.
error	string or null	Error message when the audit could not complete.

Example input

{
    "startUrl": "https://github.com/",
    "timeoutSeconds": 10,
    "followRedirectTarget": true
}

Example output

{
    "inputUrl": "https://github.com/",
    "wellKnownUrl": "https://github.com/.well-known/change-password",
    "https": true,
    "ok": true,
    "httpStatus": 301,
    "classification": "redirect",
    "isRedirect": true,
    "isDirectServe": false,
    "redirectLocation": "https://github.com/settings/security",
    "redirectTargetUrl": "https://github.com/settings/security",
    "redirectIsHttps": true,
    "sameOriginRedirect": true,
    "redirectTargetChecked": true,
    "redirectTargetReachable": true,
    "redirectTargetStatus": 200,
    "score": 85,
    "grade": "A",
    "issues": [],
    "recommendations": [
        "The /.well-known/change-password convention is correctly implemented. Periodically re-check after deploys or identity-provider migrations."
    ],
    "error": null
}

Security

• Fetches public HTTP/HTTPS URLs only; URLs with credentials are rejected.
• Private IPv4, private IPv6, and loopback targets are blocked, hostnames are DNS-resolved, and resolutions to private ranges are rejected (SSRF defense).
• Redirects are never followed automatically. The redirect Location is revalidated through the same SSRF checks before the actor optionally performs one additional fetch to confirm the target page loads.
• Only /.well-known/change-password on the audited host, and its declared redirect target, are ever fetched. No other links on the site are followed.
• No login, no cookies are stored, no JavaScript is executed, and no page content is retained beyond a small Content-Type check.

Pricing

Event	Price
Actor start	$0.005 per run
Domain audited	$0.01 per result

A typical single-domain audit costs $0.015.

FAQ

What is the well-known change-password URL? It is a convention defined by the W3C/WHATWG specification "A Well-Known URL for Changing Passwords" (https://w3c.github.io/webappsec-change-password-url/). Sites that support it serve /.well-known/change-password, which redirects password managers and browsers directly to the account's password-change form, so users and tools do not need to search for it manually.

Why does a 200 response still lose points? The specification's model is a redirect. Some sites serve the password-change form directly at the well-known path instead of redirecting to it. This still works for most password managers, so it is scored as a partial pass rather than a hard failure, but it is flagged so the site owner can align with the published convention.

Does this actor change or submit anything? No. It only performs read-only GET requests to the well-known path and, optionally, its redirect target, and reports what it finds.

What if the domain does not implement the convention at all? A 404 or 410 response is reported as not-found with a low score and a recommendation to implement the redirect.