Free website security check
A quick check of three things every site needs: a sound encrypted connection, the security headers that protect visitors, and protection against forged email in your domain's name. A result in under a minute, no sign-up.
What this checks
- A valid HTTPS certificate, with old encryption versions (TLS 1.0 / 1.1) switched off
- HTTP redirects to HTTPS
- Security headers: HSTS, CSP, X-Frame-Options and more
- Protection against forged email: SPF and DMARC records
- Further DNS records: CAA and DNSSEC
This is a light check from outside, three of the 18 tools in the full scan. It does not look for exposed files, open ports, components with known vulnerabilities or the site's code. The full scan does.