Website security check
Is your website telling browsers how to protect your visitors? Type your address to check HTTPS and the key security headers, get a grade, and see what to fix.
What security headers do
Every time someone opens your website, your server sends a few lines of instructions before the page itself. These headers tell the browser how strict to be. They cost nothing, and they shut down whole classes of attack.
HTTPS and HSTS
HTTPS encrypts the connection. HSTS (Strict-Transport-Security) tells the browser to use HTTPS for your site every time, for as long as the max-age says, even if someone types http:// or clicks an old link.
Content-Security-Policy
A CSP lists where scripts, styles and images may load from. If an attacker manages to inject a script into a page, the browser refuses to run it. It's the strongest header and the one that takes the most testing.
The small ones that still matter
X-Content-Type-Options stops browsers guessing file types. Framing protection (frame-ancestors or X-Frame-Options) stops other sites loading your pages in a hidden frame to trick clicks. Referrer-Policy keeps full page addresses private when visitors click away. Permissions-Policy limits which browser features, like the camera, your pages can use.
Each header is documented in MDN's HTTP headers reference (opens in a new tab), and the OWASP Secure Headers Project (opens in a new tab) keeps a list of recommended values.
What this check can't see
Headers are one layer. They don't tell you whether your software is up to date, whether your admin logins use MFA, or whether a form can be abused. For that you need a deeper review. Our penetration testing service tests your site and network with your permission, and our cybersecurity services keep the fixes in place.
Questions about the website check
Is this a penetration test or vulnerability scan?
No. It's a passive check. We request your home page once, the way any browser does, and read the security headers in the reply. We don't probe for weaknesses, try logins or crawl other pages. A real penetration test goes much further and needs your written permission.
Can I check a website I don't own?
The headers we read are public, but please only check sites you own or manage. The tool is meant to help you fix your own setup, and it limits how many checks one visitor can run.
Will adding these headers break my site?
Most won't. X-Content-Type-Options, Referrer-Policy and framing protection rarely cause problems. HSTS and Content-Security-Policy need more care: start HSTS with a short max-age, and run a new CSP in report-only mode first so you can see what it would block.
Why is my grade different on www and without www?
They're often separate configurations. We follow redirects and grade the address your visitors end up on, but the HTTP redirect test and some headers can differ between the two. Check both, and make one redirect to the other.
Want us to fix this?
Get a free IT assessment. We look at your setup and give you a plain-English list of what to fix first. No cost and no obligation.