Free tool
Website security & SSL check
Test your website's SSL certificate, HTTPS setup and security headers in seconds — with a grade and plain-English fixes. One normal page request, no scanning.
We only read public information — the same thing anyone on the internet can see. Nothing is stored and we will not contact you.
What we check
What a secure website gets right
- HTTPS & certificate
- A valid, trusted SSL/TLS certificate, with at least three weeks before it expires.
- TLS version
- TLS 1.2 or 1.3. Older versions have known weaknesses and are rejected by modern browsers.
- HTTP → HTTPS redirect
- Visitors who type your address without https:// should be sent straight to the secure version.
- HSTS
- Tells browsers to only ever use HTTPS for your site, for at least six months.
- Content-Security-Policy
- Limits which scripts and resources can load — the strongest defence against cross-site scripting.
- Clickjacking & sniffing
- X-Frame-Options or frame-ancestors, and X-Content-Type-Options: nosniff.
- Privacy headers
- Referrer-Policy and Permissions-Policy limit what leaks to other sites and which browser features pages can use.
- Version disclosure
- Server headers that reveal exact software versions make it easy for attackers to match known exploits.
FAQ
Common questions
What does the website security check test?
It loads your home page the way a browser does and checks HTTPS, the SSL/TLS certificate and its expiry date, the TLS version, whether plain HTTP redirects to HTTPS, and the security headers that protect visitors: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also flags server software versions you are advertising to attackers.
Is this a vulnerability scan or penetration test?
No. It makes one normal page request — no attacks, no port scanning and no login attempts — so it is safe to run on any live website. It checks configuration, not code. To find vulnerabilities in the application itself you need a web application penetration test.
What happens when an SSL certificate expires?
Browsers show a full-page security warning and most visitors leave. Online payments, APIs and email links that point to the site can stop working. Use automatic renewal (for example Let's Encrypt or your host's managed certificates) and monitor expiry dates.
What are security headers and why do they matter?
Security headers are instructions your server sends to browsers. They force HTTPS (HSTS), restrict which scripts can run (CSP), stop your site being framed for clickjacking (X-Frame-Options) and limit what information leaks to other sites. They are free to add and block whole classes of attack.
My site is on WordPress, Wix or Shopify. Can I still fix these?
Usually yes. WordPress sites can add headers through the web server, a security plugin or a CDN such as Cloudflare. Hosted platforms like Wix and Shopify manage most of this for you; anything they do not expose can often be added at the CDN. We can help either way.
More free tools
Want your website locked down?
We add a web application firewall, CDN, security headers and malware monitoring — and test the application itself with a web penetration test.