Free Website Security Checker

It runs a passive assessment of what your site openly serves: whether it’s on HTTPS and the TLS version + certificate validity; the six key security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy); cookie security flags (Secure, HttpOnly, SameSite); mixed content on HTTPS pages; software version disclosure in headers; and a couple of well-known misconfigurations like a publicly readable .git or .env. You get an A–F grade and a prioritised list of fixes.

No — and it’s important to be clear about that. This is an automated, passive security posture check: it only reads what your server already returns and looks for common misconfigurations. A real penetration test actively probes for exploitable vulnerabilities and is a manual, authorised engagement by a security professional. Use this tool as a fast first pass and to fix the obvious gaps; commission a proper pentest for anything handling sensitive data.

Only scan sites you own or are explicitly authorised to test. The checks here are non-intrusive (they read public responses and a couple of well-known paths), but you should still have permission. The tool is rate-limited to keep it light on the target.

Beyond protecting visitors, HTTPS and a solid security posture are trust and quality signals. Browsers warn users away from insecure sites, and a hacked or warning-flagged site loses rankings and clicks fast. Fixing these protects both your users and your search performance.