Website Security Checker
See how well a website protects its visitors, judged by what is visible from outside. The checker requests the page like a browser would and reviews encryption, security headers, cookie settings, exposed version numbers and insecure resources.
- Encrypted connection
- No sign-up
- Free to use
How to use Website Security Checker
- Enter the address of the website.
- Select Check security.
- Read the summary and deal with failed checks first.
- Go through the five groups, and use the links for a full certificate report or the complete list of headers.
Website Security Checker features
Encryption checks
HTTPS availability, certificate validity, TLS version, the redirect from HTTP and HSTS.
Security headers
Content Security Policy, nosniff, clickjacking protection, Referrer-Policy and Permissions-Policy.
Cookie flags
Secure, HttpOnly and SameSite for each cookie the page sets, with session cookies judged more strictly.
Information exposure
Version numbers in the Server header, X-Powered-By and generator tags, and the presence of security.txt.
Mixed content
Finds scripts, styles, images, frames and forms that still use plain HTTP on an HTTPS page.
Passive by design
Only ordinary page requests are made. Nothing is probed, brute-forced or exploited.
When to use Website Security Checker
- A quick review of your own site after launch or after a server change.
- Checking the basics before a formal security audit, so that the audit can focus on harder problems.
- Evaluating how carefully a supplier or service runs its website.
- Verifying that a security header you added is really being sent.
Website Security Checker FAQ
Does this tool find vulnerabilities such as SQL injection?
No. It looks at configuration that is visible in a normal response. Flaws in the application logic, outdated plugins, weak passwords or exposed admin areas can only be found by active testing, which requires the owner's permission. A clean result here means the visible basics are right, not that the site is secure.
Is it legal to check someone else's website with this?
The checker makes the same kind of requests as a browser visiting the home page and reads what the server chooses to send. It does not attempt to bypass anything. That is comparable to looking at a shop window.
What is HSTS?
HTTP Strict Transport Security is a header that tells browsers to use HTTPS for every future visit to the site, for a period the site chooses. It closes the gap in which a first request over HTTP could be intercepted before the redirect to HTTPS takes place.
Why does the Content Security Policy check warn about unsafe-inline?
A CSP is meant to stop injected scripts from running. Allowing all inline scripts with unsafe-inline permits exactly what an attacker would inject. Policies that use nonces or hashes for their own inline scripts keep the protection intact.
What do the cookie attributes do?
Secure keeps a cookie from being sent over unencrypted connections. HttpOnly hides it from JavaScript, so a script injected into the page cannot steal a session. SameSite stops the cookie from being attached to requests that originate from other sites, which blocks most cross-site request forgery.
What is mixed content?
An HTTPS page that loads some resource over plain HTTP. Browsers block such scripts and frames and may show the page as not fully secure, because an unencrypted resource can be altered on the way and used to change the page.
What can be judged from the outside
A surprising amount of a site's security posture is declared in public. The certificate, the redirect behaviour, the response headers and the attributes of cookies are sent to every visitor, and each of them either enables a protection built into browsers or leaves it switched off. These settings are cheap to get right and are the first thing both auditors and attackers look at, which makes them a sensible starting point.
The encryption group covers the route between visitor and server. HTTPS with a valid certificate is the baseline. The redirect from HTTP makes sure nobody stays on the insecure version by accident, and HSTS makes browsers skip the insecure request entirely on later visits. Together they prevent eavesdropping and tampering on public networks.
The header group covers what the browser will allow the page to do. A Content Security Policy is the strongest of these and the most work to introduce, since every legitimate script source has to be listed. The others are one-line settings: nosniff, a frame restriction and a referrer policy can be added to almost any site without side effects.
Cookies and information exposure are about limiting the consequences of a mistake elsewhere. A session cookie marked HttpOnly cannot be read by an injected script. A server that does not announce its exact version gives automated attack tools less to work with. None of this replaces keeping software updated and testing the application itself, and the report says so plainly: passing these checks is necessary, not sufficient.