Free tools
Free website security check
Type an address. See what an attacker sees first.
Type a website address to see, in seconds, whether its https, security headers, cookies and email-spoofing records are set up well. It is free, needs no signup, and reads only what is public.
It is not a vulnerability scan. It shows the basics an attacker looks at first.
What each line means
- https and the redirect: visitors reach the encrypted site, even from the plain address.
- HSTS: browsers refuse to fall back to plain http.
- Content-Security-Policy: limits what an injected script can do.
- Framing: stops your page being hidden inside another to steal clicks.
- Cookies: session cookies should be Secure and HttpOnly.
- SPF and DMARC: stop people sending email that claims to be you.
Questions people ask
Is this website security check free?
Yes, with no signup. It is limited to a few checks an hour from one connection.
What does it check?
Whether https works and http redirects to it, six security headers, cookie flags, a software version being announced, and SPF, DMARC and CAA records in public DNS.
Does it scan for vulnerabilities or malware?
No. It makes one normal request for your home page and reads public DNS. It sends no attack, and finds neither malware nor bugs. A clean result does not mean the site is safe.
Can I check a website that is not mine?
It only reads what any visitor can see, so it can run on any public site. Testing further than this needs the owner's permission.
Do you keep what I check?
No. Only a count of checks is kept, for the rate limit, not the address or who asked.
What should I fix first?
Anything marked "Fix this": https, then mail spoofing records, then HSTS. If you want a person to look, the free audit is there.