Website Security Check
Scan any domain for SSL issues, missing security headers, exposed files, cookie problems and more.
What the website security scanner checks
Need a certificate? Generate a free SSL certificate → · Check SSL expiry & chain →
HTTP security headers
HTTP security headers are response headers your server sends that instruct the browser on how to handle your content. They are one of the highest-value, lowest-effort security improvements available. The scanner checks for six critical headers: Content-Security-Policy (restricts which scripts, styles, and resources can load, preventing XSS); Strict-Transport-Security (forces HTTPS-only connections); X-Frame-Options (prevents clickjacking via iframes); X-Content-Type-Options (stops MIME-type sniffing attacks); Referrer-Policy (controls what URL information leaks to third parties); and Permissions-Policy (restricts access to browser APIs like camera, microphone, and geolocation).
SSL/TLS configuration
Even if you have an SSL certificate installed, misconfiguration can undermine your security. The scanner checks that your certificate is valid, not expired, and signed by a trusted CA; that your server is not accepting deprecated TLS 1.0 or TLS 1.1 connections (which violate PCI-DSS); that weak cipher suites like RC4 and 3DES are disabled; and that the full certificate chain including intermediates is served correctly. A complete TLS audit can be the difference between a passing and failing payment processor security assessment.
HSTS — HTTP Strict Transport Security
HSTS is a response header that instructs browsers to only ever connect to your site over HTTPS, and to remember that decision for a configurable duration. Without HSTS, a user's first visit (or any visit where the browser has cleared its cache) can be downgraded to HTTP by a man-in-the-middle attacker before it redirects to HTTPS — a technique called an SSL stripping attack. The scanner checks whether HSTS is set, whether max-age is at least one year (31536000 seconds), and whether includeSubDomains and preload directives are present.
Cookie security flags
Cookies that store session tokens or authentication data without proper security flags are a significant attack surface. The Secure flag ensures the cookie is never sent over plain HTTP, preventing interception on non-HTTPS connections. The HttpOnly flag prevents JavaScript from reading the cookie, meaning even a successful XSS attack cannot exfiltrate session tokens. The SameSite attribute (Strict or Lax) prevents cross-site request forgery (CSRF) attacks. The scanner inspects all Set-Cookie headers and individually flags any that are missing these protections.
Exposed sensitive files
Developers frequently leave sensitive configuration files publicly accessible by accident — a misconfigured web server, a forgotten deployment artefact, or an incorrectly set document root. The scanner probes for files that should never be publicly reachable: .env (environment variables including database passwords and API keys), .git/config (version control metadata and remote URLs), wp-config.php (WordPress database credentials), and several others. An exposed .env file is one of the most common causes of full server compromise.
DNS CAA records
A Certification Authority Authorization (CAA) DNS record lets you specify which Certificate Authorities are permitted to issue SSL certificates for your domain. Without a CAA record, any of the hundreds of trusted CAs in the world can issue a certificate for your domain — and certificate misissuance incidents (intentional or accidental) have occurred at multiple CAs. A CAA record with only your CA listed means no other CA can issue for your domain, and the CA must check the record before issuance. The scanner checks whether CAA records exist and reports which CAs are authorised. Adding one takes under a minute in any DNS provider.
Frequently asked questions
What does the website security check test?
The scanner performs a passive analysis of your publicly accessible site across eight categories: SSL/TLS certificate validity and configuration; HTTP security headers (Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy); HTTP-to-HTTPS redirection; cookie security flags (Secure, HttpOnly, SameSite); exposed sensitive files (.env, .git/config, wp-config.php, and others); DNS CAA records; server fingerprinting (whether your Server header reveals version information); and tech stack detection. Results are scored and graded A–F for quick assessment.
Is the security check free?
Yes, completely free with no account or signup required. The scanner performs a passive, read-only analysis — it makes HTTP/HTTPS requests to your site's public URLs, reads response headers, and checks for publicly accessible files. It does not brute-force, fuzz, inject payloads, or conduct any active exploitation. It is safe to run against any domain you own or have permission to scan.
What are HTTP security headers?
HTTP security headers are response headers sent by your web server that instruct the browser how to behave when loading and running your page. Content-Security-Policy (CSP) is the most powerful — it specifies exactly which domains can serve scripts, styles, fonts, and images, dramatically reducing the impact of XSS attacks. HSTS enforces HTTPS-only connections. X-Frame-Options (or the CSP frame-ancestors directive) prevents your site from being embedded in an iframe for clickjacking. X-Content-Type-Options: nosniff stops the browser from guessing content types. Referrer-Policy controls what URL is sent in the Referer header to third-party sites. All of these can be added to most web servers in under 10 minutes.
What is HSTS?
HSTS (HTTP Strict Transport Security) is a response header that tells browsers to only ever connect to your domain over HTTPS — never HTTP — for a specified period. The header looks like: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Once a browser sees this header, it will refuse to connect over plain HTTP for the duration of the max-age (one year in this example), even if the user types http:// manually. The preload directive allows your domain to be included in browsers' built-in HSTS preload lists, providing protection even on the very first visit before any headers have been seen.
Why is my Content-Security-Policy flagged as a warning?
A CSP header exists but contains directives that weaken its protection: 'unsafe-inline' allows inline scripts and styles (the most common XSS vector), and 'unsafe-eval' allows dynamic code execution via eval(). To fix these, replace inline scripts with external files or use script nonces/hashes. Many modern JavaScript frameworks support nonce-based CSP without requiring code changes. A strict CSP without unsafe directives is one of the most effective mitigations against XSS exploitation.
What is a DNS CAA record and why does it matter?
A CAA (Certification Authority Authorization) DNS record declares which Certificate Authorities are allowed to issue SSL certificates for your domain. A CAA record like 0 issue "letsencrypt.org" means only Let's Encrypt can issue certificates — any other CA that receives a certificate request for your domain must check this record and refuse. Without a CAA record, any of the hundreds of trusted CAs worldwide can issue a certificate for your domain. Real-world incidents of certificate misissuance — both accidental and through CA compromise — have demonstrated why restricting this matters. Adding CAA records is a two-minute DNS change that provides meaningful protection against certificate fraud.