Free website security check
Enter your website's domain to check its HTTPS set-up and security headers, with a grade and a plain-English fix for each finding.
Passive and free. No sign-up. What this check does
What this tool does and does not do. It is passive: it only reads information that is already public. It requests your home page once over http:// and once over https://, reads the TLS certificate and the response headers, and stops. It does not scan ports, crawl your site, fuzz forms, try to log in or probe for vulnerabilities. We do not ask for your name or email address. The domain you enter is sent to our checker service to run the lookups; see our privacy page. Only check domains you own or manage.
What we check
- HTTPS redirect: does http:// send visitors to https://?
- TLS certificate: issuer, expiry date and whether it matches your domain.
- Security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, frame protection, Referrer-Policy and Permissions-Policy (OWASP Secure Headers Project).
How the grade works is explained on our methodology page.
FAQ
Is this a penetration test or vulnerability scan?
No. It reads what any browser sees on one normal visit to your home page. It cannot find software vulnerabilities or malware.
Will it slow down or affect my website?
No. It makes one normal request to http:// (to see the redirect) and one to https://, like a single visitor.
Why is my grade low when the site works fine?
Security headers are optional extras that browsers use to block some attacks. A working site can still be missing them. Each finding explains the fix.