Free website security check

Is your website secure? Find out in seconds.

Paste your address and get an A–F security grade with the issues that matter most, ranked by real-world risk. Passive and read-only: we look at what any visitor’s browser already sees.

Passive scan. Nothing is attacked without your permission.

What the free check looks at

HTTPS and certificates: HTTP to HTTPS redirect, certificate trust and expiry, TLS version, HSTS.
Security headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
Cookies and software: missing Secure/HttpOnly/SameSite flags, server and PHP versions on show, outdated JavaScript libraries, mixed content.
WordPress: public core version, known vulnerabilities in core, plugins and themes, outdated components, listed usernames, XML-RPC.
Email spoofing: SPF and DMARC records for your domain, plus a security.txt file.

What you get back

An A–F grade and a 0–100 score you can re-check after every fix.
Every issue in plain language, ranked from critical to informational.
Step-by-step fixes for your first 3 issues, free. Copy-paste lines for nginx, Apache (.htaccess), Cloudflare and WordPress.
A monthly re-check for one site when you create a free account.

Deeper tests, only with your permission

Once you verify that you own the domain (a DNS record, a file or a meta tag) and give explicit consent, paid plans run deeper tests:

Exposed .env, .git, backups, database dumps, phpinfo and debug logs.
TLS protocols and ciphers, open ports, directory listing, admin panels.
Injection tests (SQLi, XSS, SSTI, open redirect), CORS, CSRF and JWT issues.
For stores: cart and checkout price tampering, coupon abuse, card-testing exposure and skimmer signals (unknown or changed checkout scripts, fake payment forms, lookalike domains).
Injected code such as fake CAPTCHA / ClickFix pages and blockchain-loaded scripts.

What no remote scanner can see

A remote scan sees what the internet sees: your pages, headers, certificates and DNS. It can’t read your server’s files, your database or your hosting panel, so a clean grade is a strong signal, not a guarantee. We say exactly what we checked and what we didn’t, and the deeper tests only run after you prove you own the site.

Frequently asked questions

Is the free website security check safe to run?

Yes. It only makes the same kind of requests a normal visitor’s browser makes: pages, headers, certificates and public DNS records. Nothing is attacked and no load is added.

How is the grade calculated?

Each finding has a severity. Critical and high issues, such as no HTTPS or a plugin with a known vulnerability, pull the score down far more than missing best-practice headers. The letter grade comes from the score.

Do I need to install anything?

No. There is no plugin and no code to add for the free check. You only add a DNS record, file or meta tag if you want the deeper, consent-based tests.

Does it work for sites that aren’t WordPress?

Yes. Every site gets the HTTPS, header, cookie, software and email checks. WordPress sites also get core, plugin, theme and user checks.

Guides with copy-paste fixes

Guide

More free checks

Free · Instant · No sign-up

Find out your grade before someone else does.