Website Security Checker

One free scan covering SSL/TLS, security headers, cookie flags, exposed sensitive files, CAA records and server fingerprinting — with an overall A–F grade and copy-paste fixes for anything that fails.

8 Categories in One Scan Copy-Paste Fix Snippets 100% Free

Enter a website to scan

How It Works

Enter a URL

Type any domain or full URL. No account, no email, no signup required to run a scan.

We run 8 passive checks

SSL/TLS, headers, cookies, exposed files, CAA and fingerprinting — all read-only HTTP requests, nothing intrusive.

Get a grade and the fix

See your A–F score plus copy-paste config snippets for whatever's failing — not just a list of problems.

What We Check

Category	Weight	What it looks at
SSL/TLS Configuration	30%	Certificate validity and expiry, TLS protocol version, weak cipher suites, key strength.
Security Headers	35%	Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
Cookie Flags	15%	Whether cookies set the Secure and HttpOnly attributes, and whether SameSite is configured.
Exposed Files	15%	Probes for common accidentally-public files: .env, .git/config, wp-config.php backups, .DS_Store.
DNS CAA Records	5%	Whether a CAA record restricts which certificate authorities may issue for your domain.
Server Fingerprinting	5%	Whether your Server or X-Powered-By header leaks specific software version numbers.

One Scan8 categories, a few seconds

Copy-Paste FixesNot just findings

A–F GradeClear overall score

Passive & Read-OnlyNo exploitation, ever

Secure by designYour URL is processed instantly over an encrypted connection and never stored on our servers.

Encrypted in transitSubmitted over HTTPS/TLS — nothing is sent in plain text.

Never storedThe site you check and its results are not saved to any database or log.

No third-party sharingYour data is never shared with ads, trackers, or outside services.

Processed instantlyChecked on request and discarded immediately after the response.

About Website Security Checker

What Is a Website Security Checker?

A website security checker scans a site for common security issues — missing security headers, outdated software signatures, malware indicators, and misconfigurations — giving you a quick baseline read on a site's security posture.

How to Use the Security Checker

Enter the URL you want to check
Click Check Security
Review flagged issues
Address each item with your host or developer

Key Features

Multiple security signals checked at once — headers, malware indicators, and more
Clear, prioritized results

Who Uses This Tool

Site owners run a baseline security check periodically. Developers verify security headers are properly configured after a deployment.

Frequently Asked Questions

Does a clean result mean my site is fully secure?
No — this covers common, checkable signals; it's not a substitute for a full professional penetration test on a high-value or sensitive site.

Is this tool free?
Yes, checking website security is completely free.

Understanding Website Security Signals

Why security headers matter

Security headers are instructions your server sends to the browser about how to treat your page — they don't require any code changes to your application logic, just server configuration. A missing Content-Security-Policy is the single most common reason a site is vulnerable to cross-site scripting (XSS): without it, any injected script runs with full trust. The other headers each close a smaller, specific gap: clickjacking (X-Frame-Options), MIME-sniffing attacks (X-Content-Type-Options), referrer leakage (Referrer-Policy), and unwanted access to device features from embedded content (Permissions-Policy).

HSTS and why max-age matters

Strict-Transport-Security tells the browser "never load this site over plain HTTP again," closing the window an attacker has to intercept a redirect from HTTP to HTTPS. The max-age value matters: anything under a year is considered too short to meaningfully protect returning visitors, which is why this checker specifically verifies max-age is at least 31536000 seconds (365 days), not just that the header exists.

Cookie flags: Secure, HttpOnly, SameSite

A cookie without the Secure flag can be sent over an unencrypted connection if one is ever forced. Without HttpOnly, client-side JavaScript (including any injected via XSS) can read the cookie directly — turning a minor script injection into full session theft. SameSite restricts whether the cookie is sent on cross-site requests, which is a core defense against CSRF attacks.

Why exposed files are a critical finding

Files like .env, .git/config, or a leftover wp-config.php.bak are meant to never be reachable over HTTP at all — they typically contain database credentials, API keys, or full source history. Unlike a missing header (a hardening gap), a truly exposed file is an active, often trivially exploitable leak, which is why this is one of the highest-weighted findings in the report.

CAA records

A CAA (Certification Authority Authorization) DNS record specifies which certificate authorities are allowed to issue certificates for your domain. Without one, any publicly trusted CA can issue a certificate for it — including one issued in error or by an attacker who briefly gains control of validation. It's a low-cost, defense-in-depth addition most sites simply haven't gotten around to.

Server fingerprinting

A Server or X-Powered-By header that discloses an exact version number (e.g. "nginx/1.18.0" instead of just "nginx") hands an attacker a head start: they can look up known vulnerabilities for that exact version instead of having to guess. Removing or generalizing these headers doesn't fix an underlying vulnerability, but it does remove a convenient shortcut for finding one.

How This Compares to Other Free Scanners

Capability	This Tool	Typical Header-Only Scanners
Security headers grading	✓ Yes	✓ Yes
SSL/TLS configuration grading	✓ Yes	✕ Usually separate tool
Cookie flag inspection	✓ Yes	✕ Rare
Exposed sensitive file detection	✓ Yes	✕ Rare
DNS CAA record check	✓ Yes	✕ Rare
Copy-paste fix snippets per platform	✓ Nginx, Apache, .htaccess, Node.js	✕ Findings only, no fixes
Account or email required	✓ Not required	✓ Usually not required

Frequently Asked Questions

What does this tool actually check?

Eight categories in one pass: SSL/TLS certificate and protocol strength, six critical security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), cookie security flags, commonly-exposed sensitive files, DNS CAA records, and server version fingerprinting.

Is this scan safe to run on any site?

Yes. Every check is passive and read-only — we only send normal HTTP requests (the same kind your browser sends) and read the response. Nothing is injected, nothing is exploited, and no login or account is touched.

How is the overall grade calculated?

Each category is weighted and scored, then combined into a 0-100 score and an A+ to F letter grade. TLS configuration carries the heaviest weight, followed by security headers, then cookies, exposed files, CAA, and fingerprinting.

What's the difference between this and the SSL Checker?

SSL Checker goes deep on just the certificate and TLS handshake. This tool checks that plus everything around it — headers, cookies, exposed files, CAA — giving you the fuller picture in one report.

My site got a low grade — what do I do first?

Start with anything marked red (exposed files or a failing TLS grade) — those are the highest-impact issues. Then use the Fix It panel to copy the exact header directives for your server and add them one at a time, re-scanning after each change.

Why does a missing CAA record only get a small penalty?

CAA records are a defense-in-depth measure, not a vulnerability — most sites never set one and are still secure. It's worth adding, but it matters far less than an expired certificate or a missing CSP.

Will adding a Content-Security-Policy break my site?

It can, if your site loads scripts/styles from third-party domains that a strict policy blocks. Start with the default-src 'self' snippet shown here, then test thoroughly and widen the policy to explicitly allow any third-party resources you actually use.

Do I need to fix every single item to be secure?

No single header is make-or-break on its own — think of each as one layer of defense. Fixing the high-weight items (TLS, CSP, HSTS, exposed files) gets you most of the way; the rest are worthwhile hardening on top.

Is this the same as SecurityHeaders.com or Mozilla Observatory?

Similar goal, different scope. SecurityHeaders.com only checks headers; Mozilla Observatory adds TLS and a few extras. This tool combines headers, TLS, cookies, exposed files and CAA in one report, and is the only one of the three that gives you copy-paste fix snippets instead of just findings.

Why is my score different from another security scanner?

Every scanner weighs categories differently, and there's no universal standard. Use the category breakdown (not just the letter grade) to see exactly what's driving your score here, and treat any scanner's grade as a guide, not gospel.

Does a perfect score mean my site can't be hacked?

No. This checks server-level configuration hygiene, not application-level vulnerabilities like SQL injection, broken authentication, or business logic flaws. A perfect score removes an entire category of easy wins for an attacker, but it's one layer, not a full security audit.

Can I run this against a staging or password-protected site?

Only if it's reachable over the public internet without authentication — the scanner can't log in or bypass HTTP auth prompts. For an internal-only site, you'd need to run the equivalent checks from inside your network instead.

How often should I re-run this scan?

Whenever you change server config, deploy a new CMS/plugin, or renew a certificate, plus a periodic check (monthly is reasonable) since exposed files and expiring certificates are the kind of thing that silently creep back in.