Is your website safe?

This free scanner runs a passive, read-only sweep of your website's public surface - the same response a browser receives - and grades how well it's hardened against common web attacks. It runs across four categories, returns a 0-100 score and an A-F grade, and gives you a prioritized list of fixes. Nothing is exploited, no login is attempted, and no data is stored. It's broader than a headers-only check: it also looks at transport security, mixed content, cookie flags, and version disclosure.

1. Scan your URL. Get your 0-100 score and the category breakdown.
2. Lock down HTTPS. Ensure the whole site is HTTPS, plain HTTP redirects to HTTPS, and HSTS is enabled.
3. Add security headers. Start with a Content-Security-Policy in report-only mode, then add X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
4. Fix mixed content. Switch any HTTP resources on HTTPS pages to https:// so browsers stop blocking them.
5. Reduce exposure. Set Secure and HttpOnly flags on cookies and strip version numbers from your Server, X-Powered-By, and generator tags.

Security isn't just an IT concern - it directly affects revenue and rankings. Browsers label non-HTTPS pages as "Not Secure," which scares away visitors at the worst possible moment. HTTPS is a confirmed Google ranking signal, and a hacked or blacklisted site can be dropped from search results entirely until it's cleaned up.

Most damaging breaches don't require sophisticated attacks - they exploit basic misconfigurations: a missing Content-Security-Policy that lets injected scripts run, cookies without the HttpOnly flag that get stolen via XSS, or an exposed software version that points attackers straight at a known vulnerability. The fixes are usually a few lines of server or CDN configuration, which is why a quick scan delivers an outsized return. For authoritative guidance, see the OWASP Secure Headers Project and MDN's web security docs.

90-100 (A): Strong posture. Keep dependencies patched and monitor for regressions.

80-89 (B): Good - close the one or two remaining gaps (often CSP or HSTS).

65-79 (C): Several gaps leave you exposed to common attacks. Work the priority fixes.

Below 65 (D/F): Significant or critical gaps. Start with HTTPS and the high-impact headers immediately.

This is a passive configuration scan. It assesses how your site is set up to resist attacks by reading public responses. It deliberately does not perform malware analysis, deep TLS certificate-chain inspection, port scanning, authenticated testing, or any kind of penetration test. For those, pair this with a dedicated malware/blacklist scanner and, for sensitive applications, a professional security assessment. Think of this tool as the fast first pass that catches the most common, highest-impact misconfigurations.