Website security check
Loads your home page the way a visitor's browser does and checks the settings that block common attacks: forced HTTPS, script limits, clickjacking protection and safe cookies. Each gap comes with the exact header or DNS record to add.
What we check
HTTPS and the http:// redirect, HSTS, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags, software versions in headers, DNSSEC and CAA. We follow up to five redirects.
What we don't check
Certificate expiry and details (this check can't read them), other pages, plugins or software bugs. It finds common exposures attackers look for; it isn't a penetration test. The domain and results aren't stored or logged.
How it works
Enter your domain and our server loads the home page the way a browser would, following up to five redirects, and reads the response headers. It checks that plain http:// is sent to HTTPS, and looks for HSTS, a Content-Security-Policy, clickjacking protection, the content-type, referrer and permissions headers, cookie flags, and server software versions shown in the headers. It then looks up DNSSEC and CAA records for the domain. The result is a grade from A to F and a list of fixes, each with the header or record to add.
Reading your result
- Grade A or B
- The settings a browser can enforce for you are in place. Run it again after a redesign, a new host or a new plugin, since those often change headers.
- No HTTPS redirect or no HSTS
- Visitors can still be sent to the unencrypted site, where a page can be read or changed on the way. Redirect http:// to https:// and add the Strict-Transport-Security header.
- No Content-Security-Policy
- The browser will run any script that ends up in the page. A policy limits scripts to the sources you list, which blunts injected code.
- Cookie or version warnings
- Cookies without Secure and HttpOnly are easier to steal, and a version number in a header tells an attacker which known bugs to try.
Questions
What are security headers?
Instructions your web server sends with each page that tell the browser to be stricter: use HTTPS only, refuse to be shown inside another site's frame, run scripts only from listed sources. They cost nothing and are set in the server, host or CDN settings.
Where do I add the headers?
Wherever your site is served from: the web server's configuration, your host's control panel, or the CDN in front of it. Each finding shows the exact line to add. Add them one at a time and reload the site to check nothing broke, especially with Content-Security-Policy.
Does a good grade mean my site can't be hacked?
No. This reads the home page's headers and the domain's DNS. It doesn't test your code, plugins, passwords or other pages. It finds common exposures; for the network side, run the exposure scan.