How to use the website security checker
- Enter the site address (a bare domain is checked over HTTPS; paste a full URL to check a specific page) and press Run security check.
- Read the summary line and the 'What to fix first' list; failures come before warnings.
- Open each group (Transport, Headers, Cookies, Content, Published policies, Email & DNS) to see every observation with its explanation and a copy-ready example where one exists.
- Copy the plain-text report to share it with whoever maintains the site, and re-run after changes.
Features
- HTTPS availability, http to https redirect type, certificate expiry, hostname match, chain trust and TLS version
- HSTS, Content Security Policy (with unsafe-inline, unsafe-eval and wildcard detection), X-Content-Type-Options, framing, Referrer-Policy, Permissions-Policy and cross-origin isolation headers
- Cookie flags (Secure, HttpOnly, SameSite, prefixes) reported by name only; cookie values are never stored or shown
- Mixed content scan of the HTML for http:// scripts, stylesheets, frames and images on an HTTPS page
- robots.txt, sitemap.xml and RFC 9116 security.txt presence, with Contact and Expires parsed
- SPF and DMARC analysis, DNSSEC validation status and CAA records for the domain
- Grouped report with pass, warning, failure and info counts, a fix-first list and a copyable plain-text version
What each group covers
Transport looks at whether the site is reachable over HTTPS, whether plain http:// requests are upgraded with a permanent redirect, and whether the certificate is valid, trusted and covers the hostname. Headers examines the response headers that tell browsers how to protect visitors: HSTS pins HTTPS, CSP restricts where scripts may come from, X-Content-Type-Options stops MIME sniffing, X-Frame-Options or frame-ancestors prevents clickjacking, and Referrer-Policy limits what leaks to other sites.
Cookies lists the flags on every cookie the responses set: Secure keeps it off plain HTTP, HttpOnly keeps it away from scripts, SameSite limits cross-site requests. Content scans the HTML for mixed content and reports caching and CORS on the document. Published policies checks security.txt, robots.txt and sitemap.xml. Email & DNS checks SPF, DMARC, DNSSEC and CAA for the domain; DKIM, MTA-STS and TLS-RPT are in the dedicated email security checker.
How to read the levels
Fail means a browser-visible or exploitable gap in what could be observed, such as an expired certificate or a cookie without Secure on an HTTPS site. Warning means a hardening measure is missing or weak. Info is context that needs no action. Pass means that one observation looked right. The summary counts observations; it is deliberately not a grade, because a site with perfect headers can still have an application bug, and a site missing several headers can be perfectly well run.
Limitations and responsible use
Only public, unauthenticated GET, DNS and TLS observations are made from a single server. Nothing is logged into, submitted or exploited; JavaScript is not executed, so resources added at runtime and cookies set after sign-in are not seen. 'Not detected' is therefore never proof of absence. Only test sites you own or are authorised to test, and never use the report to make claims about a site you do not control.
- One request per check, with a total budget of about 20 seconds; slow sites may show some groups as not checked.
- Header values longer than 8 KB are truncated; HTML is scanned up to 1.5 MB.
- Private addresses, non-standard ports and URLs with credentials are refused so the tool cannot probe internal networks.