Free website security checker

Yes. It's free, needs no account or email address, and has no paid version. It checks one site at a time from your browser; a few checks per hour per visitor keep it from being used to scan the internet.

Enter its address above. The check takes 10 to 20 seconds and looks at the things attackers check first: HTTPS and the certificate, security headers, cookie flags, exposed private files, mixed content and email-spoofing records. Each problem comes with a plain-English fix you can pass to whoever runs your site.

Yes. It makes a handful of ordinary requests, the same ones a browser or search engine makes: the home page, the http:// version, /.well-known/security.txt, and two well-known private file addresses (/.git/HEAD and /.env), plus public DNS lookups. It never logs in, submits forms, guesses passwords or scans ports.

The score is the share of points earned across the graded checks: a warning earns half, a problem none, and notes don't count. A is 90 or more, B 80, C 65 and D 50. Broken HTTPS or a publicly readable .git or .env file means an F whatever the rest says, because either can undo everything else.

Most problems here don't break anything you can see. Missing security headers, for example, only matter when someone attacks the site, which is exactly when you want them. Many are one-line changes in the web server or hosting settings; each finding says what to add.

No. A good grade means the basics are in place: the things automated attack tools look for first. It can't see outdated plugins, weak passwords, or bugs in your own code. For that you need a security review or penetration test by someone you've given permission to test the site.

Because scammers who can't break into your site can still send email that looks like it's from your domain, to your customers. SPF says which servers may send your email, and DMARC tells providers like Gmail and Outlook to reject or junk mail that fails. A domain that never sends email should still publish them.

No. The address and the results are not stored or logged. The result is kept in memory for half an hour, so you can still email it to yourself, and checking the same site again within five minutes shows the same report without contacting it again. Like every page on this site, the server log records your visit.

Yes. After a check, enter your email address under the grade and the full report, with every fix, is sent to you once. Your address isn't kept. If you'd also like the free AI Coding Starter Kit and occasional updates, tick the box: you'll get a link to confirm first, and you can unsubscribe at any time.

A few checks per hour and about thirty a day from one network, so it can't be used to scan the internet for weak sites. If you need to check many sites, for example for clients, get in touch.