Free Website Security Check: Test Your Site in 1 Minute

Free website security check

Find out what an attacker can see about your website before they look. Enter your domain and in about a minute you get a list of problems, how serious each one is, and step-by-step fixes written for owners, not only for developers.

Free. About one minute. Safe to run on a live website.

What the check looks at

Area	What we check	Why it matters
HTTPS & certificate	Expiry, trust chain, outdated TLS 1.0/1.1, redirect from http to https	Browsers warn visitors away from sites with broken or weak encryption.
Security headers	CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy	These tell browsers to block common attacks such as clickjacking and script injection.
Email spoofing	SPF and DMARC records	Without them, anyone can send email that looks like it came from your domain.
DNS	DNSSEC, CAA, nameservers, domain expiry	Protects your domain from being redirected or a certificate being issued to someone else.
Exposed files	Leftover .env, .git, backup and config files	These can leak passwords and database keys.
Network	Open ports such as databases, SSH and FTP	Services open to the whole internet are a common way in.
Software	Publicly visible versions of servers, CMS and JavaScript libraries	Old versions with known vulnerabilities are easy targets.

Is it safe to run on my live website?

Yes. The public check behaves like a careful visitor: it reads public DNS records and makes ordinary web requests. It does not try to log in, submit forms, change data or flood your server. Deeper tests only run after you prove you own the site, for example by adding a DNS record.

What you get

A security score out of 100 and a count of issues by severity.
An action plan that lists each task, who should do it (you, your developer or your hosting company), how long it takes, and the exact clicks for providers such as Cloudflare, GoDaddy and Namecheap.
A ready-made message for your developer you can send by WhatsApp or email.
A PDF report you can keep or share.

What an automated check cannot do. It cannot test things behind a login, payment flows, or business-logic mistakes such as one customer seeing another customer's orders. Those need a person. If your site handles payments or personal data, consider a manual penetration test.

Common questions

How long does the website security check take?

Usually about one minute. Large sites or slow servers can take a little longer.

Do I need technical knowledge?

No. Each problem comes with a plain-language explanation and an action plan. Tasks that need a developer are bundled into a message you can forward.

Can I check a website I do not own?

The public check only reads information any visitor can see. Deeper tests are limited to websites whose ownership you have verified.

Is a security check the same as a penetration test?

No. An automated check finds common configuration problems quickly. A penetration test is done by a person who tries to break in the way a real attacker would.

Check your website now

Enter your domain. You get a score, every problem in plain language, and an action plan that says who should fix what.