Website Security Check

A free, passive security check of your website: we read what a normal visit loads and what is public, and list every problem with a one-line fix. We never log in, scan ports or try to break in.

about a minutepart of the full health check

01What we check

What this check looks at.

HTTPS and certificate

HTTPS, a redirect from http://, a valid certificate and when it expires, and whether the server still accepts old TLS versions.

Security headers

Seven headers that protect visitors, such as Strict-Transport-Security, Content-Security-Policy and X-Content-Type-Options, plus cookie flags and mixed content.

Known vulnerabilities

Known vulnerabilities (CVEs) in the software your page shows, looked up on the day in the NVD, OSV.dev and CISA's catalog of actively exploited ones.

Exposed keys

Secret keys left in the JavaScript your page loads. Any key we find is shown masked, with only its first and last 4 characters.

Email spoofing and domain

The SPF and DMARC records that stop others sending mail as your domain, CAA, and your domain's expiry date.

02FAQ

Questions people ask.

The full tool and how it works: Website Health Check.

Is this a penetration test?

No. It is passive: we load your page like a visitor, read public DNS records and check which TLS versions your server accepts. We never send logins, call your site's database or API, or request extra paths. For a deeper review, ask us about a security audit.

Where do the vulnerabilities come from?

From public databases, looked up for the software versions your page shows: the NVD, OSV.dev (with the GitHub Advisory Database, CC BY 4.0) and CISA's Known Exploited Vulnerabilities catalog. This product uses the NVD API but is not endorsed or certified by the NVD.

Is the result part of a bigger report?

Yes. You get the full Website Health Check: speed, security, SEO, mobile and AI search readiness, with one score out of 100.

03More free checks