Website Security Checker
Check a site's HTTPS setup, security headers, cookie flags and mixed content, then get a grade and plain-language fixes for each issue.
Site to check
Security grade
Run a check to see your grade.
Results
Headers received
Why website security is a marketing issue too
A weak setup can expose your visitors to data theft, get your site flagged by browsers, and erode the trust you worked hard to earn. Small businesses are not exempt. Automated attacks scan every site they can find, regardless of size.
What this checker looks at
Enter a public URL and the tool fetches the page, reads its response headers, and tests each one against current best practice. Results show green for good, amber for things to improve and red for areas that need attention, each with a specific fix.
- HTTPS and redirects: whether the site is encrypted and whether http visitors are sent to https.
- Strict-Transport-Security (HSTS): tells browsers to only ever connect over https.
- Content-Security-Policy (CSP): limits which scripts and resources can load, the strongest defence against cross-site scripting.
- X-Frame-Options: stops other sites from framing your pages for clickjacking.
- X-Content-Type-Options: prevents browsers from guessing file types, which blocks MIME-sniffing attacks.
- Referrer-Policy and Permissions-Policy: limit data leaks and unused browser features.
- Cookies, version disclosure and mixed content: cookie flags, software version numbers, and http resources on https pages.
The older X-XSS-Protection header is shown for reference only. Modern browsers no longer use it, so it does not affect your grade.
This is a passive header check, not a penetration test. It does not look for malware, outdated plugins or server vulnerabilities.
Frequently asked questions
How do I add security headers in WordPress?
You can set them in your server configuration (Apache .htaccess or Nginx), at your CDN such as Cloudflare, or with a small snippet in your theme. Your host can often add them for you.
Can a strict Content-Security-Policy break my site?
Yes, if it blocks scripts you rely on, like analytics or chat widgets. Roll it out with Content-Security-Policy-Report-Only first, review the reports, then enforce it.
Who is this tool for?
Site owners, web developers, agencies checking client sites, and anyone curious about how well a website protects its visitors.