SSL / HTTPS
Whether the certificate is valid and about to expire, and whether HTTP redirects to HTTPS.
FREE TOOL / Security check
How secure is
your website?
We check your SSL certificate, security headers, cookies and e-mail spoofing protection. No attacks or vulnerability probes are sent to your site.
Results for
Most important findings
See the full report
Enter your details to see every finding, what is already in place and how to fix each issue. We will not share your details.
What is already in place
This check only looks at public settings.
Open ports, outdated software and vulnerabilities in your application need a real penetration test. Our team runs it after verifying that you own the domain and with your written approval.
What we check
Security headers
HSTS, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Information leaks
Server software and CMS versions visible to anyone, insecure cookies and mixed content.
E-mail spoofing
The SPF and DMARC records that stop others sending e-mail in your name, plus CAA and security.txt.
What we do not do
No port scans, no attack attempts, no logins. The scan reads only what any browser can see, and it runs from Cloudflare’s network.
Frequently asked
Yes. It makes a few ordinary page requests, like a visitor would, and reads public DNS records. It sends no attack or vulnerability probes and does not slow your site down.
No. The check covers public configuration only. Vulnerabilities in your code, plugins or server need a penetration test, which our team carries out with your approval.
We use it only to send you the report and to answer questions about it. You can read how we handle personal data in our Data Protection Notice.
