Free Website Security Checker

It runs a passive assessment of what your site openly serves: whether it’s on HTTPS, the TLS version + certificate validity, and whether deprecated TLS 1.0/1.1 are still enabled; whether HTTP redirects to HTTPS and if HSTS is preload-eligible; the six key security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) plus Content-Security-Policy quality; cookie security flags (Secure, HttpOnly, SameSite); mixed content and Subresource Integrity on third-party scripts; email spoofing protection (SPF and DMARC via DNS); CAA certificate-issuance control and DNSSEC; software version disclosure; a security.txt contact; and well-known misconfigurations like a publicly readable .git or .env. You get an A–F grade and a prioritised list of fixes.

No — and it’s important to be clear about that. This is an automated, passive security posture check: it only reads what your server already returns and looks for common misconfigurations. A real penetration test actively probes for exploitable vulnerabilities and is a manual, authorised engagement by a security professional. Use this tool as a fast first pass and to fix the obvious gaps; commission a proper pentest for anything handling sensitive data.

Only scan sites you own or are explicitly authorised to test. The checks here are non-intrusive (they read public responses and a couple of well-known paths), but you should still have permission. The tool is rate-limited to keep it light on the target.

Beyond protecting visitors, HTTPS and a solid security posture are trust and quality signals. Browsers warn users away from insecure sites, and a hacked or warning-flagged site loses rankings and clicks fast. Fixing these protects both your users and your search performance.