Free tool
How well protected is this website?
Enter a website and get a plain A to F grade for its security headers, HTTPS redirect and protection against forged email, with the fixes in order of importance.
We only look at what any visitor can see. Nothing is stored.
- 01
Enter an address
Any public website. We read what every visitor can already see.
- 02
We run the checks
Security headers, the HTTP to HTTPS redirect, cookie flags, and the DNS records that stop forged email.
- 03
Get a grade and a fix list
Problems come most serious first, each with the change that fixes it.
Questions
→Is it fine to check a site that isn't mine?
Yes. We only read what a browser visit and a DNS lookup already reveal. We never try to log in, guess paths or exploit anything. The deeper check for exposed files is limited to sites you have proven you own.
→Is this a penetration test?
No. It is a passive configuration check, in the same category as other public header graders. A good grade means the basics are in place, not that the site cannot be attacked.
→Why would a site with a serious finding never get a good grade?
A takeover risk or an exposed secret outweighs everything else, so the grade is capped no matter how many other boxes are ticked.
→Do you keep the results?
No. Nothing about the site you check is stored. To limit abuse we count checks per visitor per day, using a scrambled form of the network address.